心动吧黑客BLOG

 这一个文章和我以前发布的一个文章正好成了一个对比（文章连接），如果上一次是茅。那么此次这个就是盾了.为什么这样说？请看一下上一篇的文章。因为上一次是直接修改数据库的防下载表而不会造成数据沉淀在数据库里面。那么换一个思想来讲。假设在数据库当中并没有这一个防下载表。但是却有防下载功能。

例图：

 先要在此感谢evil的提醒,昨天(2009-3-11)时上网后。发现网上有很多新版本的SHELL发布。而且还声称是终结版(我自己都没把自己终结。倒被你终结了).而且采用了加密手段。。现在我将下载回来程序。。打开并分析一下。现在把报告给大家。请慎重使用。。。。

心动吧asp在线-不加密加强版-是市面上目前功能最强的.速度最好的一款asp后门

 此内部版修正了:关于无端口的sql连接出错.通用三种SQL连接方式

#!/usr/bin/perl
# IIS 5.0 FTP Server / Remote SYSTEM exploit
# Win2k SP4 targets
# bug found & exploited by Kingcope, kcope2<at>googlemail.com
# Affects IIS6 with stack cookie protection
# Modded by muts, additional egghunter added for secondary larger payload
# Might take a minute or two for the

....

========原理：
windows的身份验证一般最终都是在lsass进程，默认模块是msv1_0.dll，而关键在其导出函数LsaApLogonUserEx2，
本程序通过注入代码到lsass进程hook LsaApLogonUserEx2，截取密码。只要有身份验证的过程，
LsaApLogonUserEx2就会触发，如ipc$,runsa,3389远程桌面登陆等。

程序对不同系统做了处理，在

....

Site: http://www.80sec.com
Date: 2009-8-26
From: http://www.80sec.com/release/fly_flash.txt
80SEC — know it then hack it !
 

[ description ]

Author: www.80vul.com [Email:5up3rh3i#gmail.com]
Release Date: 2009/06/22
References: http://www.80vul.com/ie8/Multiple%20Exploiting%20IE8IE7%20XSS%20Vulnerability.txt

Overview:

Tags[not include

...

例如我扫到的IP：127.0.0.1

运行:cmd
运行iis5hack(流光里就有）
      c:\>iis5hack 127.0.

..

WPAD (Web Proxy Auto Discovery) is a method used by web clients to automatically
locate a browser configuration file used to connect through proxy.

Successful attack on WPAD guarantees attackers full access
on user data sent to Internet

...

IIS 6.0 webdav Exploit version:phpshell : http://securiteweb.org/?p=117

J’avais écrit u exploit de la version PHPSHELL CODE de iis6.0 webdav vul.

Pour la détail

Checks for a vulnerability in IIS6 that allows arbitrary users to access secured WebDAV folders by searching for a password-protected folder and attempting to access it. As of May 2009, this vulnerability is unpatched.

A list of well known folders (almost 900) is used by default. Each one is checked, and if returns an authentication request (401), another attempt is tried with the malicious

...

微软IIS 6.0的WebDAV的远程身份验证绕道漏洞

archive: http://milw0rm.com/sploits/2009-IIS-Advisory.pdf

   *** FOR IMMEDIATE RELEASE *** *** FOR IMMEDIATE RELEASE ***

Microsoft IIS 6.0 WebDAV Remote Authentication Bypass

Discovered by Kingcope - May 12th, 2009

漏洞描述：Win32k.sys是WINDOWS的GDI驱动程序，包含大量复杂的图形界面处理，由于其中大量代码是从WIN3.1中修改过来，因此成了WINDOWS漏洞多发之地。

这个漏洞主要是因为Windows 7 在其NtUserGetDc

.....