Webshell succeeds in obtaining, then next step certainly was the server proposes the power the work. Actually, discovered from the very beginning browsing jurisdiction time discovered that he should be an individual server, because the hypothesized main engine is impossible to present this kind preliminarily wrong.
Goes in has a look at server's environment first, the child has been all of a sudden silly, the heaven, do not play me, the DEF plate is completely NTFS form anything cannot do, but the C plate is only FAT32 (system plate), your this does not pull, manager eldest brother, you are ruthless.
Therefore enters C the plate, looked, manager eldest brother is not the public security, waits for me to go in is catching me, who doesn't manage to let you that attract me to come.
Looked under program the files folder to have a look at him to install any software. Hey! Radmin, PCanywhere, this eldest brother, if 3389 opened that too to be really strong continually. Is long-distance manages him to use, on difference useless pigeon.
This catalog found the *.cif document to C:\Documents and Settings\All Users \ Application Data \ Symantec \ under pcAnywhere, altogether two. Like chart (5)
Figure 5
The password explains the tool with PCanywhere, 1 second, the account number password came out, anything had not said that linked directly, invaded originally should be calculates has finished, might such be simple, thinks a little is unfair to safety net's brothers, ha-ha had a look at other means.
Had not seen he installs SERV-U, but perhaps was installs in other table of contents, therefore put out Serv-u to raise the power tool, HaoSec.TS impressively glistened user appeared in the manager group, was quite melancholy, could this manager give me to have the lock, such was opening, did not go in I to who. Smiled with continually the young pig.
Now is left over the question was looks for the terminal, opened has looked for his port, has not opened opens to him, might see on his server also had many users, should open, how or to manage that.
Therefore in raises on the power tool to input cmd /c net start >d:/dir/1.txt, serves the system obviously arrives at the website root directory in the 1.txt document.
May see he has opened the terminal service, is moving cmd /c netstat - the >d:/dir/2.txt discovery not to open 3389 ports.
Therefore what may be affirmative was the terminal port was changed, then present's question is seeks for the terminal service station correspondence the port is how many, if found that the question to solve. I have uploaded FPORT, is uses in examining the system service correspondence port, but this tool's flaw is, moves he to have the USERS group jurisdiction at least, therefore uploads the ASPX wooden horse, what is melancholy is the server does not support .NET. The word road is blocked.
However a main road passes Rome, I let look that I one all looks for the line not, therefore compares 2.txt to attempt each suspicious port, 2 minutes, the server fell to the enemy.
Other pages: : <<Prev * 1 * 2 * 3 * Next>>
|
You are here: hacking technology
> invades the examination
> Content
Category: Home
> invades the examination
