转移自有道笔记->临时记录->操作时笔记
记录了渗透学习中linux和windows常用的命令,linux部分直接转载的,需要重新总结.
WIN
net
- 查看共享连接
net use
- 增加远程共享
net use \host /u:user pw
- 查看域中当前主机列表
net view /domain
- 查看当前域中的用户
net user /domain
- 添加本地用户
net users name pw /add 其中的add也可以简写为ad(仅在win7下测试)
- 添加本地用户到本地管理员组
net localgroup Administrators username /add 其中的add也可以简写为ad(仅在win7下测试)
- 查看组
net localgroup
- 查看本地组
net localgroup groupname
- 查看域中组的信息
net group /domain
- 查看当前机器所在的域名
net config workstation
- 查看当前服务器所在域名
net config server
系统信息相关
- 显示系统信息(设备,补丁等)
systeminfo
- 查看远程主机的系统信息
systeminfo /S ip /U domainuser /P pw
- 显示进程和服务
tasklist /svc
- 显示所有进程和和Dll信息
tasklist /m
- 显示进程和所有者
tasklist /v
- 查看远程主机的进程列表
tasklist /S ip /v
- 搜索所有exe文件
dir /a /s /b c:.exe
- 显示服务信息
sc query
- 当前目录下(包含子目录,不区分大小写)找出内容包含’然并卵’字符串的文件
findstr /si 然并卵 *.txt
- 搜索当前目录下(包含子目录)敏感文件名称(还可以效防添加名称)
dir /s *pass == *cred == *vnc == *.config
- 设置当前配置禁用防火墙
netsh advfirewall set currentprofile state off
- 保存主机上所有wifi信息
netsh wlan export profile folder=. key=clear
- 设置端口转发
netsh interface portproxy add v4tov4 listenport=3000 listenaddress=l.l.l.l connectport=4000 connectaddress=2.2.2.2
- 启用远程访问
reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
- 启用远程协助
reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
- 修改远程访问端口
reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp" /v PortNumber /t REG_DWORD /d 12345 /f
注册表相关操作
- 查找注册表中的密码
reg query HKLM /f password /t REG_SZ /s
Linux
查看操作系统信息
1
2
3
4
| cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release # Debian
cat /etc/redhat-release # Redhat
|
1
2
3
4
5
6
| cat /proc/version
uname -a
uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-
|
1
2
3
4
5
6
7
| cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set
|
应用和服务
1
2
3
4
| ps aux
ps -ef
top
cat /etc/services
|
1
2
| ps aux | grep root
ps -ef | grep root
|
1
2
3
4
5
6
| ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archives
ls -alh /var/cache/yum/
|
1
2
3
4
5
6
7
8
9
10
| cat /etc/syslog.conf
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/cups/cupsd.conf
cat /etc/inetd.conf
cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/ | awk '$1 ~ /^.*r.*/'
|
1
2
3
4
5
6
7
8
9
10
11
12
| crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root
|
1
2
3
4
| grep -i user [filename]
grep -i pass [filename]
grep -C 5 "password" [filename]
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" # Joomla
|
网络相关
1
2
3
| ifconfig -a
cat /etc/network/interfaces
cat /etc/sysconfig/network
|
1
2
3
4
5
6
| cat /etc/resolv.conf
cat /etc/sysconfig/network
cat /etc/networks
iptables -L
hostname
dnsdomainname
|
-网络通信
1
2
3
4
5
6
7
8
9
10
| lsof -i
lsof -i :80
grep 80 /etc/services
netstat -antup
netstat -antpx
netstat -tulpn
chkconfig --list
chkconfig --list | grep 3:on
last
w
|
-路由缓存
用户相关
1
2
3
4
5
6
7
8
9
10
11
12
| id
who
w
last
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/
grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}' # 列出超级用户
awk -F: '($3 == "0") {print}' /etc/passwd #列出超级用户
cat /etc/sudoers
sudo -l
|
1
2
3
4
5
6
7
8
| ls -ahlR /root/
ls -ahlR /home/
其他用户的操作记录
cat ~/.bash_history
cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history
cat ~/.php_history
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
| cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key
|
文件系统相关
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
| ls -alh /var/log
ls -alh /var/mail
ls -alh /var/spool
ls -alh /var/spool/lpd
ls -alh /var/lib/pgsql
ls -alh /var/lib/mysql
cat /var/lib/dhcp3/dhclient.lea
cat /etc/httpd/logs/access_log
cat /etc/httpd/logs/access.log
cat /etc/httpd/logs/error_log
cat /etc/httpd/logs/error.log
cat /var/log/apache2/access_log
cat /var/log/apache2/access.log
cat /var/log/apache2/error_log
cat /var/log/apache2/error.log
cat /var/log/apache/access_log
cat /var/log/apache/access.log
cat /var/log/auth.log
cat /var/log/chttp.log
cat /var/log/cups/error_log
cat /var/log/dpkg.log
cat /var/log/faillog
cat /var/log/httpd/access_log
cat /var/log/httpd/access.log
cat /var/log/httpd/error_log
cat /var/log/httpd/error.log
cat /var/log/lastlog
cat /var/log/lighttpd/access.log
cat /var/log/lighttpd/error.log
cat /var/log/lighttpd/lighttpd.access.log
cat /var/log/lighttpd/lighttpd.error.log
cat /var/log/messages
cat /var/log/secure
cat /var/log/syslog
cat /var/log/wtmp
cat /var/log/xferlog
cat /var/log/yum.log
cat /var/run/utmp
cat /var/webmin/miniserv.log
cat /var/www/logs/access_log
cat /var/www/logs/access.log
ls -alh /var/lib/dhcp3/
ls -alh /var/log/postgresql/
ls -alh /var/log/proftpd/
ls -alh /var/log/samba/
|
1
2
3
4
5
| ls -alhR /var/www/
ls -alhR /srv/www/htdocs/
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/
ls -alhR /var/www/html/
|
1
2
3
| mount
df -h
cat /etc/fstab
|
1
2
3
4
5
| find / -writable -type d 2>/dev/null # 可写目录
find / -perm -222 -type d 2>/dev/null # 可写目录
find / -perm -o w -type d 2>/dev/null # 可写目录
find / -perm -o x -type d 2>/dev/null # 可执行目录
find / \( -perm -o w -perm -o x \) -type d 2>/dev/null # 可写可执行目录
|
准备与攻击
1
2
3
4
| find / -name perl*
find / -name python*
find / -name gcc*
find / -name cc
|
1
2
3
4
5
| find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp*
find / -name ftp
|
参考